registry / AI-agent control-surface risk / @memxai/cairn

@memxai/cairn

Cairn — an append-only journal for AI agents. Git-like memory, without the complexity.

This report shows the evidence for @memxai/cairn@0.3.3, the only known version.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The install hook unconsentedly mutates global and project AI-agent control surfaces. The opt-outs do not provide affirmative consent, so this meets the blocking policy for install-time agent control changes.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package globally or in a project, unless an environment-variable opt-out applies.

Impact

These changes alter instructions agents read and commands run during sessions without an affirmative setup step.

Mechanism

The hook writes global agent instructions or adds a Claude Code session hook to the consumer project’s settings.

Policy narrative

During npm installation, the package runs setup automatically. Global installs write instructions into global agent files, while local installs add agent instructions and a Claude Code session hook to the project. Environment-variable opt-outs exist, but no affirmative consent gate precedes these changes.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/setup/global.jsdist/setup/install.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.mjs during installation.
The postinstall script invokes global setup for global installs and project setup for local installs; neither requires affirmative consent.
Global setup writes Cairn rules into global agent instruction files, including Claude Code’s primary file.
Project setup installs a Claude Code SessionStart hook in the consumer project’s .claude/settings.json.

Evidence against

The package provides environment-variable opt-outs, but they default off and do not require affirmative consent before these changes.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 235 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 47-87json

47 "import": "./dist/mcp/server.js"

48 }

49 },

50 "files": [

51 "dist",

52 "bin",

53 "scripts/postinstall.mjs",

54 "README.md",

55 "docs",

56 "LICENSE",

57 "NOTICE",

58 "!docs/superpowers",

59 "!dist/**/*.map"

60 ],

61 "engines": {

62 "node": ">=18"

63 },

64 "scripts": {

65 "build": "tsc -p tsconfig.json",

66 "clean": "rm -rf dist",

67 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L67

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L67

68 "prepublishOnly": "npm run clean && npm run build",

69 "test": "vitest run",

70 "test:watch": "vitest",

71 "test:coverage": "CAIRN_COVERAGE=1 vitest run --coverage",

72 "bench": "npm run build && node scripts/bench.mjs",

73 "typecheck": "tsc -p tsconfig.json --noEmit",

74 "cairn": "node bin/cairn.js",

75 "wedge": "node scripts/wedge-eval.mjs",

76 "wedge:tokens": "npm run build && node scripts/wedge-tokens.mjs",

77 "eval": "tsx eval/cairn.eval.ts",

78 "eval:anchors": "tsx eval/anchors.eval.ts"

79 },

80 "dependencies": {

81 "@modelcontextprotocol/sdk": "^1.0.4",

82 "better-sqlite3": "^11.7.0",

83 "zod": "^3.23.8"

84 },

85 "devDependencies": {

86 "@types/better-sqlite3": "^7.6.11",

87 "@types/node": "^22.10.0",

dist/setup/install.jsView file

Lines 1-21javascript

1import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";

2import { execFileSync } from "node:child_process";

3import { join, dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/setup/install.jsView on unpkg · L1

dist/cli/screens.jsView file

Lines 1-21javascript

1import { AGENT_FILES } from "../setup/install.js";

2import { GLOBAL_AGENT_FILES } from "../setup/global.js";

3/**

4 * Plain-text summaries for the install / setup flows. Shared by the `cairn` CLI

5 * and the npm postinstall step. Deliberately non-graphical — no banner, no boxes

6 * — so setup is quiet whether a human or an agent runs it.

7 */

dist/cli/index.jsView file

Lines 62-102javascript

62 i++;

63 }

64 else

65 flags[key] = true;

66 }

67 }

68 else

69 positionals.push(a);

dist/core/store.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/store.js#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/setup/install.jsView file

1import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs"; L2: import { execFileSync } from "node:child_process"; L3: import { join, dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/setup/install.jsView on unpkg · L1

Findings

1 Critical4 High4 Medium5 Low

CriticalAi Agent Control Hijackdist/cli/screens.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/setup/install.js

HighRuntime Package Installdist/cli/index.js

HighSemantic Analysis Limiteddist/core/store.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @memxai/cairn@0.3.3.

The versions list below shows the verdict for each recorded version.

Avoid installing @memxai/cairn@0.3.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-17 04:49:29.185Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.3.3latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 16, 2026, 12:26 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code