@mnemom/mnemom@0.17.0

⚠ Under review

Transparent AI agent tracing

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 730 KB of source, external domains: 127.0.0.1, aap.mnemom.ai, api-staging.mnemom.ai, api-us1.mnemom.ai, api.mnemom.ai, claude.com, docs.mnemom.ai, gateway-staging.mnemom.ai, gateway-us1.mnemom.ai, gateway.mnemom.ai, preview.mnemom.ai, staging.mnemom.ai, www.mnemom.ai

Source & flagged code

4 flagged

dist/lib/oauth.jsView file

Lines 5-45javascript

5 * fronts the MCP control plane) instead of doing a raw Supabase session login.

6 * This yields SCOPED access tokens (`mcp:read` / `mcp:write`) — not the full

7 * Supabase god-token — so a leaked CLI credential can only do what the CLI was

8 * granted, and grants are independently revocable server-side (MNE-805/806).

9 *

10 * Two interactive flows, both standards-based:

11 * - Authorization Code + PKCE with a loopback redirect (the `wrangler login`

12 * pattern): open the browser to /authorize, catch the redirect on a

13 * localhost listener, exchange code+verifier at /token.

14 * - RFC 8628 Device Authorization Grant (`--no-browser` / headless): POST

15 * /device_authorization, print the user_code + verification_uri, poll

16 * /token honoring `authorization_pending` and `slow_down`.

17 *

18 * Everything is driven off RFC 8414 discovery

19 * (/.well-known/oauth-authorization-server) — endpoint paths are NOT hardcoded.

20 * The public client_id is obtained via RFC 7591 Dynamic Client Registration and

21 * cached, so there is no client secret to embed (the AS advertises

22 * token_endpoint_auth_method "none" — public clients only).

23 */

24import * as http from "node:http";

25import * as crypto from "node:crypto";

26import { execFile } from "node:child_process";

27import { getApiUrl } from "./config.js";

High

Child Process

Package source references child process execution.

dist/lib/oauth.jsView on unpkg · L25

28// The scopes the CLI requests. The AS currently advertises mcp:read + mcp:write

29// (scopes_supported in discovery); we request both so a single login covers the

30// full command surface. If discovery ever narrows what's available we intersect

31// against scopes_supported before asking, so we never request an unknown scope.

32const REQUESTED_SCOPES = ["mcp:read", "mcp:write"];

33const CLIENT_NAME = "Mnemom CLI";

34const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";

35// Loopback login waits at most this long for the browser round-trip before

36// giving up and freeing the port.

37const LOOPBACK_TIMEOUT_MS = 5 * 60 * 1000;

38// Cadence for the "…still waiting for you to finish signing in" heartbeat that

39// both interactive login poll loops emit, so a multi-minute browser sign-in

40// doesn't read as a hung CLI (matches the card-write retry tick in try-me).

41const LOGIN_HEARTBEAT_MS = 15 * 1000;

42// Refresh-token retry policy (R6 / MNE-7394). A transient AS 5xx or a dropped

43// network connection during refresh must be retried with bounded exponential

44// backoff rather than collapsed into the re-login signal — a one-second AS

45// hiccup or a flaky Wi-Fi moment must not invalidate a valid, long-lived

dist/rc-proxy.mjsView file

74// stdout: exactly one line, `READY <port> <ca.pem path>`, once listening. Node ≥ 18, no deps. L75: import http from "node:http"; L76: import https from "node:https"; ... L80: import path from "node:path"; L81: import { execFileSync } from "node:child_process"; L82: L83: const MITM_HOST = "api.anthropic.com"; L84: const env = process.env; L85:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/rc-proxy.mjsView on unpkg · L74

73// L74: // stdout: exactly one line, `READY <port> <ca.pem path>`, once listening. Node ≥ 18, no deps. L75: import http from "node:http"; L76: import https from "node:https"; ... L80: import path from "node:path"; L81: import { execFileSync } from "node:child_process"; L82: ... L86: function die(msg) { L87: process.stderr.write(`mnemom-code-rc-proxy: ${msg}\n`); L88: process.exit(2);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/rc-proxy.mjsView on unpkg · L73

dist/commands/agent.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/agent.js#virtual:normalized:round1View on unpkg

Source & flagged code

4 flagged · loading source

dist/lib/oauth.jsView file

25import * as crypto from "node:crypto"; L26: import { execFile } from "node:child_process"; L27: import { getApiUrl } from "./config.js";

High

Child Process

Package source references child process execution.

dist/lib/oauth.jsView on unpkg · L25

dist/rc-proxy.mjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/rc-proxy.mjsView on unpkg · L74

Findings

4 High2 Medium5 Low

HighChild Processdist/lib/oauth.js

HighSame File Env Network Executiondist/rc-proxy.mjs

HighCommand Output Exfiltrationdist/rc-proxy.mjs

HighSemantic Analysis Limiteddist/commands/agent.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mnemom/mnemom@0.17.0.

See all versions of @mnemom/mnemom for other recorded verdicts.

Review the evidence and your use of @mnemom/mnemom@0.17.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 20:40:59.769Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.