@echomem/mcp@1.4.38
EchoMem MCP bridge: cloud-first memory tools and the Agent Doctor workspace forensics report (cost ledger + 3D repo city)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a dangerous, user-invoked AI-agent control and self-update capability, not confirmed malware. The package lacks install-time execution, so it does not meet the blocking threshold.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs echomem-mcp init, setup, or update; runtime update check runs while the MCP server is active.
Impact
Can steer agent behavior toward EchoMem, trigger package commands at agent lifecycle events, and replace the runtime with a later registry version.
Mechanism
Global AI-agent configuration injection and self-updating runtime
AI rationale
This is a dangerous, user-invoked AI-agent control and self-update capability, not confirmed malware. The package lacks install-time execution, so it does not meet the blocking threshold.
Evidence
package.jsondist/setup.jsdist/hud/hooks.jsdist/index.jsdist/headless-runtime.jsdist/update-check.js~/.codex/config.toml~/.codex/AGENTS.md~/.codex/hooks.json~/.claude/CLAUDE.md~/.claude/settings.json~/.config/echomem/mcp-runtime
Network endpoints2
echo-mem-chrome.vercel.appregistry.npmjs.org/%40echomem%2Fmcp/latest
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/setup.js: init invokes setup for all detected agents and enables save hooks by default.
- dist/setup.js writes EchoMem directives into ~/.codex/AGENTS.md and ~/.claude/CLAUDE.md, including preference over other memory providers and automatic saving.
- dist/hud/hooks.js installs Codex/Claude Stop hooks that execute this package's CLI.
- dist/index.js auto-downloads newer package versions after a background registry update check.
- dist/headless-runtime.js runs npm install of the selected newer version into a durable user runtime.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Agent configuration and hooks are reached only through explicit init/setup/update commands.
- No source evidence of credential harvesting, arbitrary remote code execution, or stealth exfiltration.
- Default network API is package-aligned: echo-mem-chrome.vercel.app.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
7 flaggeddist/forensics.jsView file
19import path from "node:path";
L20: import { execFileSync } from "node:child_process";
L21: import { calculateContextMetrics } from "./context-metrics/calculate.js";
High
dist/headless-runtime.jsView file
65'if (!fs.existsSync(entry)) throw new Error("EchoMem MCP runtime is missing; run `npx -y @echomem/mcp@latest update --all`.");',
L66: "await import(pathToFileURL(entry).href);",
L67: "",
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/headless-runtime.jsView on unpkg · L65dist/hud/autostart.jsView file
Findings
5 High6 Medium5 Low
HighChild Processdist/forensics.js
HighShell
HighSame File Env Network Executiondist/hud/server.js
HighExternal Ai Agent Control Surface Mutationdist/hud/hooks.js
HighPrevious Version Dangerous Deltadist/setup.js
MediumDynamic Requiredist/headless-runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/hud/autostart.js
MediumShips Wasm Moduledist/city/vendor/rive.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @echomem/mcp@1.4.38.
See all versions of @echomem/mcp for other recorded verdicts.
- Review the evidence and your use of @echomem/mcp@1.4.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.