@memxai/cairn@0.3.3
Cairn — an append-only journal for AI agents. Git-like memory, without the complexity.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe install hook unconsentedly mutates global and project AI-agent control surfaces. The opt-outs do not provide affirmative consent, so this meets the blocking policy for install-time agent control changes.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package globally or in a project, unless an environment-variable opt-out applies.
Impact
These changes alter instructions agents read and commands run during sessions without an affirmative setup step.
Mechanism
The hook writes global agent instructions or adds a Claude Code session hook to the consumer project’s settings.
Policy narrative
During npm installation, the package runs setup automatically. Global installs write instructions into global agent files, while local installs add agent instructions and a Claude Code session hook to the project. Environment-variable opt-outs exist, but no affirmative consent gate precedes these changes.
AI rationale
The install hook unconsentedly mutates global and project AI-agent control surfaces. The opt-outs do not provide affirmative consent, so this meets the blocking policy for install-time agent control changes.
Evidence
package.jsonscripts/postinstall.mjsdist/setup/global.jsdist/setup/install.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/postinstall.mjs during installation.
- The postinstall script invokes global setup for global installs and project setup for local installs; neither requires affirmative consent.
- Global setup writes Cairn rules into global agent instruction files, including Claude Code’s primary file.
- Project setup installs a Claude Code SessionStart hook in the consumer project’s .claude/settings.json.
Evidence against
- The package provides environment-variable opt-outs, but they default off and do not require affirmative consent before these changes.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/setup/install.jsView file
1import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
L2: import { execFileSync } from "node:child_process";
L3: import { join, dirname, resolve } from "node:path";
High
Child Process
Package source references child process execution.
dist/setup/install.jsView on unpkg · L1Findings
1 Critical4 High4 Medium5 Low
CriticalAi Agent Control Hijackdist/cli/screens.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/setup/install.js
HighRuntime Package Installdist/cli/index.js
HighSemantic Analysis Limiteddist/core/store.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @memxai/cairn@0.3.3.
See all versions of @memxai/cairn for other recorded verdicts.
- Avoid installing @memxai/cairn@0.3.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.