Xiaomi (小米) MiMo Code installation package found to contain undisclosed modules

Developers discovered that the official installation package for Xiaomi (小米) MiMo Code includes two modules, trajectory-bundle and codebase-bundle, which are not present in the public repository. The trajectory-bundle module can package system prompts, conversations, model responses, and code diffs, while codebase-bundle contains a collectCodebase() function capable of traversing Git repositories, reading source code, and compressing it. While there is no evidence that collectCodebase() is currently being called or that full codebases have been uploaded, developers confirmed that Git repository addresses, commit hashes, and branch information were transmitted. Xiaomi (小米) open-sourced MiMo Code under the MIT license in June. This follows a recent incident where Zhipu AI (智谱) ZCode faced a 12-page legal notice for automatically packaging entire workspaces.