registry / Credential exfiltration / @mnemom/mnemom
@mnemom/mnemom
Transparent AI agent tracing
This report shows the evidence for @mnemom/mnemom@0.17.23. 1 of 19 known versions is blocked or flagged. The newest version, 0.17.30, is flagged. See all versions.
AI Security Review
scanned 48m ago · by lpm-firewall-aiSource inspection confirms that an Anthropic API key is sent to the package’s default Mnemom gateway during the Remote Control API-key flow, without recipient-specific consent. This concrete credential disclosure supports blocking; the manifest does not establish an install-time attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Launching the agent through the Remote Control API-key path.
Impact
The gateway receives the Anthropic credential, exposing it to that recipient beyond its intended Anthropic service.
Mechanism
The launcher passes the Anthropic key to a local proxy, which adds it as x-api-key to requests sent to the configured gateway; the default door resolves to gateway.mnemom.ai.
Attack narrative
When the agent uses API-key authentication, its Remote Control launch passes the Anthropic key to a local proxy. The proxy forwards the key in the x-api-key header to the Mnemom gateway, whose default endpoint is gateway.mnemom.ai. This exposes a service credential to the package-selected gateway without a recipient-specific consent gate; the source does not establish how the recipient uses it.
AI rationale
Source inspection confirms that an Anthropic API key is sent to the package’s default Mnemom gateway during the Remote Control API-key flow, without recipient-specific consent. This concrete credential disclosure supports blocking; the manifest does not establish an install-time attack.
Evidence
dist/commands/agent.jsdist/rc-proxy.mjsdist/lib/agent.js
Network endpoints1
gateway.mnemom.ai
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The agent resolves an Anthropic API key for API-key authentication and passes it to the Remote Control launch.
- The launcher sends that key to the proxy over stdin; the proxy puts it in the x-api-key header on requests routed to the gateway.
- The gateway door defaults to https://gateway.mnemom.ai, with an override available.
- The package manifest has no install hook; its prepublishOnly script only runs the build.
Evidence against
- The transfer is part of an agent launch and can use a configured gateway override.
- No install-time credential transfer is established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcedist/lib/update/min-version.jsView file
6*/
L7: import { spawnSync } from "node:child_process";
L8: import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";
High
Child Process
Package source references child process execution.
dist/lib/update/min-version.jsView on unpkg · L6dist/lib/oauth.js#virtual:normalized:round1View file
272// Still pending (authorization_pending / slow_down) — emit a heartbeat
L273: // every ~15s so a multi-minute approval doesn"t look hung.\n if (waitedMs >= nextHeartbeatMs) {\n display(`…still waiting for you to finish signing in (${Math.ro...
L274: * validated (https, or http on loopback) and then passed as a separate argv
High
Shell
Package source references shell execution.
dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L272dist/rc-proxy.mjsView file
Findings
1 Critical5 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/agent.js
HighChild Processdist/lib/update/min-version.js
HighShelldist/lib/oauth.js#virtual:normalized:round1
HighSame File Env Network Executiondist/rc-proxy.mjs
HighCommand Output Exfiltrationdist/rc-proxy.mjs
HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mnemom/mnemom@0.17.23.
The versions list below shows the verdict for each recorded version.
- Avoid installing @mnemom/mnemom@0.17.23. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.