registry / @echomem/mcp / 1.4.59
@echomem/mcp@1.4.59
EchoMem MCP bridge for cross-agent memory, local history import, and recall
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected findings map to local session discovery, HUD behavior, and explicit setup/runtime functions. The scanner’s severe labels were not substantiated as attack behavior by the inspected source excerpts.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI use of setup or migration features, or running the HUD and runtime updater.
Impact
No unconsented credential transfer, foreign control-surface hijack, or other confirmed attack effect was established.
Mechanism
The package locates local agent session/configuration files, adds EchoMem hooks, and maintains a versioned runtime installation.
AI rationale
The manifest has no install lifecycle hook, and the inspected findings map to local session discovery, HUD behavior, and explicit setup/runtime functions. The scanner’s severe labels were not substantiated as attack behavior by the inspected source excerpts.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a CLI entrypoint and has no preinstall, install, or postinstall hook.
- A scorer helper searches local Codex session files by session identifier.
- Another scorer helper matches values against a local Codex session index.
- The HUD monitor reads the local Codex session index to display titles.
- Migration code identifies local Claude session paths for import discovery.
- Setup resolves Codex and Claude configuration directories from environment settings or standard local directories.
- The durable entrypoint uses child-process support alongside runtime path resolution.
- The HUD server defaults to the EchoMem service and account site, with an environment override for the API base.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/durable-entry.jsView file
1import { spawnSync } from "node:child_process";
L2: import fs from "node:fs";
High
Child Process
Package source references child process execution.
dist/durable-entry.jsView on unpkg · L1dist/setup.jsView file
701};
L702: const result = spawnSync(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", `"${shellCommand}"`], spawnOptions);
L703: if (result.error)
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/setup.js:
import readline from "node:readline";
return configuredProfileDirectory("CODEX_HOME", ".codex");
return configuredProfileDirectory("CLAUDE_CONFIG_DIR", ".claude");
if (env.CLAUDE_DESKTOP_SUPPORT_DIR?.trim())
...claudeDesktopClients,
{ id: "codex", label: "Codex", kind: "command", detectDir: codexHome(), configPath: path.join(codexHome(), "config.toml"), note: "add to ~/.codex/config.toml under [mcp_servers.ech...
* can merge the user entry into ~/.claude.json without a CLI, a profile is enough to act on.
return fs.existsSync(home(".claude")) || fs.existsSync(home(".claude.json")) || claudeCodeCliAvailable();
Findings
7 High3 Medium5 Low
HighChild Processdist/durable-entry.js
HighShelldist/setup.js
HighSame File Env Network Executiondist/hud/server.js
HighCredential Redirect Persistencedist/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/hud/hooks.js
HighSemantic Analysis Limiteddist/headless-runtime.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/setup.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/hud/autostart.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @echomem/mcp@1.4.59.
See all versions of @echomem/mcp for other recorded verdicts.
- Review the evidence and your use of @echomem/mcp@1.4.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.