@echomem/mcp@1.4.52
EchoMem MCP bridge for cross-agent memory, local history import, and recall
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install lifecycle hook, but its explicit setup path broadly changes AI-agent configuration and installs commands that persist across sessions. The transcript-upload and self-updater features create a real capability risk, so this should be warned rather than blocked.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs setup, init, or update; transcript upload requires the local HUD renew action and a stored token.
Impact
Future agent sessions can invoke package commands; coding-session content can leave the device through the package service.
Mechanism
Agent-hook installation and authenticated session-memory upload.
AI rationale
The package has no install lifecycle hook, but its explicit setup path broadly changes AI-agent configuration and installs commands that persist across sessions. The transcript-upload and self-updater features create a real capability risk, so this should be warned rather than blocked.
Evidence
dist/setup.jsdist/hud/hooks.jsdist/hud/server.jsdist/headless-runtime.js~/.codex/hooks.json~/.claude/settings.json~/.codex/AGENTS.md~/.claude/CLAUDE.md~/.echomem/mcp-runtime
Network endpoints1
echo-mem-chrome.vercel.app
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit setup enables global agent guidance, skills, and lifecycle hooks by default.
- The hook installer writes commands into Codex and Claude agent hook configuration.
- The local HUD reads an active session transcript and can upload its full content to the EchoMem service.
- The runtime updater installs another release of this package, although it disables npm lifecycle scripts.
- No npm install lifecycle hook is declared, so these actions do not run merely on package installation.
Evidence against
- Configuration and hook writes require an explicit setup, init, or update command.
- The staged runtime install uses --ignore-scripts.
- No evidence of shell-obfuscated payloads, credential harvesting, or arbitrary external command execution was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
9 flaggeddist/durable-entry.jsView file
1import { spawnSync } from "node:child_process";
L2: import fs from "node:fs";
High
Child Process
Package source references child process execution.
dist/durable-entry.jsView on unpkg · L1dist/setup.jsView file
695};
L696: const result = spawnSync(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", `"${shellCommand}"`], spawnOptions);
L697: if (result.error)
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/setup.js:
import readline from "node:readline";
return configuredProfileDirectory("CODEX_HOME", ".codex");
return configuredProfileDirectory("CLAUDE_CONFIG_DIR", ".claude");
if (env.CLAUDE_DESKTOP_SUPPORT_DIR?.trim())
...claudeDesktopClients,
{ id: "codex", label: "Codex", kind: "command", detectDir: codexHome(), configPath: path.join(codexHome(), "config.toml"), note: "add to ~/.codex/config.toml under [mcp_servers.ech...
* can merge the user entry into ~/.claude.json without a CLI, a profile is enough to act on.
return fs.existsSync(home(".claude")) || fs.existsSync(home(".claude.json")) || claudeCodeCliAvailable();
Findings
7 High4 Medium5 Low
HighChild Processdist/durable-entry.js
HighShelldist/setup.js
HighSame File Env Network Executiondist/hud/server.js
HighCredential Redirect Persistencedist/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/hud/hooks.js
HighSemantic Analysis Limiteddist/headless-runtime.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/source-session.js
MediumDynamic Requiredist/headless-runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/hud/autostart.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @echomem/mcp@1.4.52.
See all versions of @echomem/mcp for other recorded verdicts.
- Review the evidence and your use of @echomem/mcp@1.4.52 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.