registry / @jungjaehoon/mama-os / 0.22.0

@jungjaehoon/mama-os@0.22.0

MAMA OS - Local AI Runtime. Your scattered knowledge, organized by AI agents that never sleep.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time code bootstraps first-party MAMA templates in ~/.mama. A user-started runtime can create an isolated Codex home, copy existing Codex authentication into it, and invoke an approval-free agent/MCP execution path. No confirmed external exfiltration or foreign-agent configuration mutation was found.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; later explicit MAMA/Codex-backed agent start

Impact

A package-controlled local AI-agent runtime can act with copied Codex credentials after the user starts it.

Mechanism

first-party agent bootstrap with local auth replication and approval-free MCP execution

Rationale

The scanner's malicious conclusion is overstated: the lifecycle hook does not mutate foreign AI-agent control files or directly exfiltrate data. However, unprompted first-party agent setup plus runtime auth copying and approval-free MCP execution warrants a warning.

Evidence

package.jsonscripts/postinstall.jsdist/agent/codex-home.jsdist/agent/codex-mcp-process.jsdist/mcp/code-act-server.jsdist/cli/index.jstemplates/skillstemplates/workspace/skill-forge~/.mama/skills~/.mama/workspace/skill-forge~/.claude/.credentials.json~/.codex/auth.json~/.mama/.codex/config.toml~/.mama/.codex/auth.json

Network endpoints1

127.0.0.1:3847

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.js automatically on install.
scripts/postinstall.js creates ~/.mama and copies package skill/workspace templates without prompting.
scripts/postinstall.js invokes `claude auth status` and checks ~/.claude/.credentials.json existence.
dist/agent/codex-mcp-process.js copies ~/.codex/auth.json into ~/.mama/.codex/auth.json when the Codex-backed agent starts.
dist/agent/codex-home.js writes an isolated Codex config with approval_policy="never"; dist/mcp/code-act-server.js exposes JavaScript execution through a local MCP tool.

Evidence against

Postinstall writes only package-owned ~/.mama paths; it does not write ~/.claude or ~/.codex.
Postinstall contains no network request primitive; its URLs are printed documentation/login strings.
Credential handling is local copying into a mode-0600 MAMA-specific home, with no package-source exfiltration path found.
The code-act MCP proxy targets only 127.0.0.1:3847 and is activated by a user-run executable/runtime flow.
CLI entrypoints require explicit commands for setup, start, or run; importing dist/index.js only re-exports modules.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 354 file(s), 3.94 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.chatwork.com, api.github.com, api.notion.com, api.slack.com, api.telegram.org, api.trello.com, claude.ai, console.anthropic.com, discord.com, fonts.googleapis.com, github.com, raw.githubusercontent.com, rdap.org, react.dev, trello.com, www.chatwork.com, www.notion.so, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

Lines 1-33json

2 "name": "@jungjaehoon/mama-os",

3 "version": "0.22.0",

4 "description": "MAMA OS - Local AI Runtime. Your scattered knowledge, organized by AI agents that never sleep.",

5 "main": "./dist/index.js",

6 "types": "./dist/index.d.ts",

7 "bin": {

8 "mama": "./dist/cli/index.js",

9 "mama-os": "./dist/cli/index.js",

10 "mama-code-act-mcp": "./dist/mcp/code-act-server.js"

11 },

12 "scripts": {

13 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build": "tsc && pnpm exec tsx scripts/generate-gateway-tools.ts && rm -rf public/viewer/js && tsc -p public/viewer/tsconfig.viewer.json && pnpm run build:ui",

15 "build:ui": "pnpm --dir ui run bundle",

16 "dev:ui": "pnpm --dir ui run dev",

17 "build:watch": "tsc --watch",

18 "build:viewer": "rm -rf public/viewer/js && tsc -p public/viewer/tsconfig.viewer.json",

19 "build:viewer:watch": "tsc -p public/viewer/tsconfig.viewer.json --watch",

20 "test": "vitest run",

21 "test:watch": "vitest watch",

22 "clean": "rm -rf dist node_modules",

23 "typecheck": "tsc --noEmit",

24 "start": "node dist/cli/index.js",

25 "bench:sample": "tsx bench/run-benchmark.ts sample",

26 "bench:full": "tsx bench/run-benchmark.ts full",

27 "bench:category": "tsx bench/run-benchmark.ts"

28 },

29 "keywords": [

30 "ai",

31 "assistant",

32 "claude",

33 "mcp",

dist/connectors/calendar/index.jsView file

Lines 1-23javascript

1"use strict";

2/**

3 * CalendarConnector — polls Google Calendar via the gws CLI tool.

4 * Uses child_process.execSync to call gws CLI commands.

5 * Skips "Using keyring backend:" prefix lines before parsing JSON.

High

Child Process

Package source references child process execution.

dist/connectors/calendar/index.jsView on unpkg · L3

6 */

7Object.defineProperty(exports, "__esModule", { value: true });

dist/multi-agent/bmad-templates.jsView file

Lines 212-248javascript

212 const day = String(now.getDate()).padStart(2, '0');

213 return `${year}-${month}-${day}`;

214}

215function sanitizeFileSegment(

dist/connectors/claude-code/index.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * ClaudeCodeConnector — reads conversation history from Claude Code's JSONL files.

4 * Polls ~/.claude/projects/<project-dir>/*.jsonl for user and assistant messages

5 * newer than the given timestamp.

6 *

7 * Each JSONL file is one session. Messages have types: user, assistant, system, etc.

8 * We extract user + assistant messages as conversation items.

9 */

10Object.defineProperty(exports, "__esModule"

scripts/generate-gateway-tools.tsView file

Lines 26-66typescript

27\`\`\`text

28Here is the image:

29~/.mama/workspace/media/outbound/screenshot.png

30\`\`\`

32**CRITICAL:** You must write the actual path \`~/.mama/workspace/media/outbound/filename.ext\` in your response text. Do NOT just describe the image — the path IS the display mechanism. Without the path, nothing is shown to the user.

34**Workflow for showing any image:**

361.

dist/cli/runtime/utilities.jsView file

Lines 42-82javascript

42 return (mod && mod.__esModule) ? mod : { "default": mod };

43};

44Object.defineProperty(exports, "__esModule", { value: true });

45exports.EMBEDDING_PORT = exports.API_PORT = void

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3const { existsSync, mkdirSync, cpSync, readdirSync } = require('fs');

4const path = require('path');

5const { execFileSync } =

dist/cli/runtime/api-routes-init.jsView file

50Cross-file remote execution chain: dist/cli/runtime/api-routes-init.js spawns dist/cli/runtime/utilities.js; helper contains network access plus dynamic code execution. L50: const node_path_1 = __importDefault(require("node:path")); L51: const node_http_1 = __importDefault(require("node:http")); L52: const session_service_js_1 = require("../../validation/session-service.js"); ... L214: // Manual refresh endpoint (kept for compatibility) L215: apiServer.app.post('/api/report/refresh', auth_middleware_js_1.requireAuth, (_req, res) => { L216: res.json({ ok: true, message: 'Viewer now renders data directly from Intelligence API' }); L217: }); ... L223: // Makes code_act available to configured legacy self-paced agents. L224: const codeActServerPath = node_path_1.default.join(__dirname, '../../mcp/code-act-server.js'); L225: try { ... L329: // committing its cursor; the 30-min cron above remains the repair pass. L330: if (process.env.MAMA_BOARD_RECONCILE === '1') {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/runtime/api-routes-init.jsView on unpkg · L50

public/favicon.icoView file

•path = public/favicon.ico kind = high_entropy_blob sizeBytes = 6172 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/favicon.icoView on unpkg

dist/agent/codex-mcp-process.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @jungjaehoon/mama-os@0.21.0 matchedIdentity = npm:QGp1bmdqYWVob29uL21hbWEtb3M:0.21.0 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/codex-mcp-process.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/connectors/calendar/index.jsView file

3* CalendarConnector — polls Google Calendar via the gws CLI tool. L4: * Uses child_process.execSync to call gws CLI commands. L5: * Skips "Using keyring backend:" prefix lines before parsing JSON.

High

Child Process

Package source references child process execution.

dist/connectors/calendar/index.jsView on unpkg · L3

dist/multi-agent/bmad-templates.jsView file

232// Avoid direct import.meta usage so this file can compile in both CJS and ESM builds. L233: const getImportMetaUrl = new Function('return import.meta.url;'); L234: return (0, path_1.dirname)((0, url_1.fileURLToPath)(getImportMetaUrl()));

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/multi-agent/bmad-templates.jsView on unpkg · L232

dist/connectors/claude-code/index.jsView file

11exports.ClaudeCodeConnector = void 0; L12: const fs_1 = require("fs"); L13: const os_1 = require("os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/connectors/claude-code/index.jsView on unpkg · L11

scripts/generate-gateway-tools.tsView file

46L47: - **List jobs**: \`curl -s http://localhost:3847/api/cron | jq\` L48: - **Create job**: \`curl -s -X POST http://localhost:3847/api/cron -H 'Content-Type: application/json' -d '{"name":"job name","cron_expr":"0 * * * *","prompt":"task prompt here"}'\... ... L56: L57: When a user asks to schedule/monitor something periodically, ALWAYS use this API — do NOT create external scripts or system crontab entries. L58: ... L104: // Write to src (for dev hot-reload) and dist (for production) L105: const srcPath = join(__dirname, '..', 'src', 'agent', 'gateway-tools.md'); L106: writeFileSync(srcPath, output, 'utf-8');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/generate-gateway-tools.tsView on unpkg · L46

dist/cli/runtime/utilities.jsView file

62exports.hasCodexBackendConfigured = hasCodexBackendConfigured; L63: const node_child_process_1 = require("node:child_process"); L64: const node_fs_1 = require("node:fs"); ... L66: const node_path_1 = __importStar(require("node:path")); L67: const node_http_1 = __importDefault(require("node:http")); L68: const config_loader_1 = require("@jungjaehoon/mama-core/config-loader"); ... L74: function parseSecurityAlertTargets(config) { L75: const rawTargets = process.env.MAMA_SECURITY_ALERT_CHANNELS; L76: if (rawTargets && rawTargets.trim()) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/runtime/utilities.jsView on unpkg · L62

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L2: L3: const { existsSync, mkdirSync, cpSync, readdirSync } = require('fs'); L4: const path = require('path'); ... L17: if (!existsSync(mamaDir)) { L18: mkdirSync(mamaDir, { recursive: true }); L19: } L20: if (!existsSync(skillsDir)) { L21: mkdirSync(skillsDir, { recursive: true }); L22: } L23: if (!existsSync(workspaceDir)) { L24: mkdirSync(workspaceDir, { recursive: true }); L25: } Payload evidence from dist/multi-agent/bmad-templates.d.ts: L1: /** L2: * BMAD Templates Utility

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L1

dist/cli/runtime/api-routes-init.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/runtime/api-routes-init.jsView on unpkg · L50

public/favicon.icoView file

•path = public/favicon.ico kind = high_entropy_blob sizeBytes = 6172 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/favicon.icoView on unpkg

dist/agent/codex-mcp-process.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/codex-mcp-process.jsView on unpkg

Findings

2 Critical6 High6 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

CriticalPrevious Version Dangerous Deltadist/agent/codex-mcp-process.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/connectors/calendar/index.js

HighShell

HighSame File Env Network Executiondist/cli/runtime/utilities.js

HighCross File Remote Execution Contextdist/cli/runtime/api-routes-init.js

HighShips High Entropy Blobpublic/favicon.ico

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/connectors/claude-code/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/generate-gateway-tools.ts

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/multi-agent/bmad-templates.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

91%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorJung Jaehoon

Maintainersjungjaehoons

Version0.22.0

PublishedJul 16, 2026

LicenseMIT

Dependencies19

Integrityverified

Package size1.73 MB

Files1,315

Keywordsaiassistantclaudemcpmemoryalways-on

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsbin → mama, mama-code-act-mcp, mama-os

Runtimenode >=22.13.0

Artifact7.41 MB · 1,315 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedTelemetryUrlStringsManifest: clean

Source & flagged code

11 flagged

package.jsonView file

Lines 1-33json

2 "name": "@jungjaehoon/mama-os",

3 "version": "0.22.0",

4 "description": "MAMA OS - Local AI Runtime. Your scattered knowledge, organized by AI agents that never sleep.",

5 "main": "./dist/index.js",

6 "types": "./dist/index.d.ts",

7 "bin": {

8 "mama": "./dist/cli/index.js",

9 "mama-os": "./dist/cli/index.js",

10 "mama-code-act-mcp": "./dist/mcp/code-act-server.js"

11 },

12 "scripts": {

13 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build": "tsc && pnpm exec tsx scripts/generate-gateway-tools.ts && rm -rf public/viewer/js && tsc -p public/viewer/tsconfig.viewer.json && pnpm run build:ui",

15 "build:ui": "pnpm --dir ui run bundle",

16 "dev:ui": "pnpm --dir ui run dev",

17 "build:watch": "tsc --watch",

18 "build:viewer": "rm -rf public/viewer/js && tsc -p public/viewer/tsconfig.viewer.json",

19 "build:viewer:watch": "tsc -p public/viewer/tsconfig.viewer.json --watch",

20 "test": "vitest run",

21 "test:watch": "vitest watch",

22 "clean": "rm -rf dist node_modules",

23 "typecheck": "tsc --noEmit",

24 "start": "node dist/cli/index.js",

25 "bench:sample": "tsx bench/run-benchmark.ts sample",

26 "bench:full": "tsx bench/run-benchmark.ts full",

27 "bench:category": "tsx bench/run-benchmark.ts"

28 },

29 "keywords": [

30 "ai",

31 "assistant",

32 "claude",

33 "mcp",

dist/connectors/calendar/index.jsView file

Lines 1-23javascript

1"use strict";

2/**

3 * CalendarConnector — polls Google Calendar via the gws CLI tool.

4 * Uses child_process.execSync to call gws CLI commands.

5 * Skips "Using keyring backend:" prefix lines before parsing JSON.

High

Child Process

Package source references child process execution.

dist/connectors/calendar/index.jsView on unpkg · L3

6 */

7Object.defineProperty(exports, "__esModule", { value: true });

dist/multi-agent/bmad-templates.jsView file

Lines 212-248javascript

212 const day = String(now.getDate()).padStart(2, '0');

213 return `${year}-${month}-${day}`;

214}

215function sanitizeFileSegment(

dist/connectors/claude-code/index.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * ClaudeCodeConnector — reads conversation history from Claude Code's JSONL files.

4 * Polls ~/.claude/projects/<project-dir>/*.jsonl for user and assistant messages

5 * newer than the given timestamp.

6 *

7 * Each JSONL file is one session. Messages have types: user, assistant, system, etc.

8 * We extract user + assistant messages as conversation items.

9 */

10Object.defineProperty(exports, "__esModule"

scripts/generate-gateway-tools.tsView file

Lines 26-66typescript

27\`\`\`text

28Here is the image:

29~/.mama/workspace/media/outbound/screenshot.png

30\`\`\`

34**Workflow for showing any image:**

361.

dist/cli/runtime/utilities.jsView file

Lines 42-82javascript

42 return (mod && mod.__esModule) ? mod : { "default": mod };

43};

44Object.defineProperty(exports, "__esModule", { value: true });

45exports.EMBEDDING_PORT = exports.API_PORT = void

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3const { existsSync, mkdirSync, cpSync, readdirSync } = require('fs');

4const path = require('path');

5const { execFileSync } =

dist/cli/runtime/api-routes-init.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/runtime/api-routes-init.jsView on unpkg · L50

public/favicon.icoView file

•path = public/favicon.ico kind = high_entropy_blob sizeBytes = 6172 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/favicon.icoView on unpkg

dist/agent/codex-mcp-process.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/codex-mcp-process.jsView on unpkg