A developer who reverse-engineered the official installation package for Xiaomi MiMo Code said the package includes two modules that do not appear in the project’s public repository: trajectory-bundle and codebase-bundle. According to the findings, trajectory-bundle can package system prompts, conversations, model replies, and code diffs, while codebase-bundle contains a function called collectCodebase() that can traverse a Git repository, read source code, and compress it into a bundle. At the same time, the developer said there is no sign that collectCodebase() is called by MiMo Code’s built-in code, and there is no evidence that a complete codebase was uploaded. The information confirmed to have been sent out mainly involves Git repository addresses, commit hashes, and branch details. Xiaomi’s MiMo Code was open-sourced under the MIT license in June. Two days earlier, Zhipu’s ZCode drew legal pressure after automatically packaging a full workspace, with a company sending a 12-page legal letter demanding data deletion.
ChainCatcher reported that a developer who reverse-engineered the official Xiaomi MiMo Code installation package found two modules not present in the public repository: trajectory-bundle and codebase-bundle.
According to the developer’s findings, trajectory-bundle can package system prompts, conversations, model responses, and code diffs. The codebase-bundle module includes collectCodebase(), a function capable of traversing a Git repository, reading source code, and compressing it into a bundle.
So far, there is no indication that collectCodebase() is invoked by MiMo Code’s built-in code, and no evidence has surfaced showing that a full codebase was uploaded. The information confirmed by the developer to have been transmitted mainly includes Git repository addresses, commit hashes, and branch details.
Xiaomi MiMo Code was open-sourced under the MIT license in June. Two days ago, Zhipu’s ZCode faced a 12-page legal letter from an enterprise demanding deletion of data after it automatically packaged a complete workspace.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
