@mnemom/mnemom@0.17.10

Transparent AI agent tracing

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The manifest has no install-time execution hook, and inspected flagged behavior is consistent with explicit CLI features, user configuration, and guarded self-update. The static signals do not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the package's CLI; status-line wrapping occurs when launching Claude Code.

Impact

No confirmed attack surface was established from the inspected behavior.

Mechanism

The launcher reads Claude settings and runs the user's configured status command through its status-line wrapper. Other inspected network and process behavior is consistent with CLI update, authentication, and proxy functions.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no automatic install hook; prepublishOnly only runs the build.
The Claude settings access in dist/commands/agent.js reads configuration to resolve the selected model; the launcher wraps a status command only for Claude Code and preserves the user's existing statusLine.
dist/lib/statusline.js reads Claude settings, wraps only a configured command statusLine, and can be disabled or bypassed when custom settings are supplied.
The minimum-version updater only proceeds in auto mode for eligible installs and invokes npm with argument arrays, not a shell.
OAuth code obtains metadata from the configured API base; the RC proxy documents a gateway-oriented Anthropic proxy flow.
The agent goal command is an explicit CLI control for gateway-inferred session goals.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

6 flagged

dist/lib/update/min-version.jsView file

Lines 1-26javascript

1/**

2 * Turn the server's minimum-CLI hard-fail (lib/version-gate.ts) into a

3 * one-retry fix: when update.mode is auto and this install can update itself,

4 * install the newest stable release satisfying the floor, in the foreground,

5 * and ask the user to re-run. Synchronous because the gate is.

6 */

7import { spawnSync } from "node:child_process";

8import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";

High

Child Process

Package source references child process execution.

dist/lib/update/min-version.jsView on unpkg · L6

9import { CLI_VERSION } from "../../version.js";

10import { classifyInstall } from "./install-method.js";

11import { isValidVersion, isPrerelease } from "./semver.js";

12import { acquireLock, loadUpdateState } from "./state.js";

13import { entryRealpath, loadUpdatePrefs, npmInvocation } from "./system.js";

14/**

15 * Returns true when the CLI was upgraded. Only in `auto` mode — `notify` means

16 * "never install without my say-so", even for a server floor. The floor is

17 * untrusted header input: it must be a plain release version before it goes

18 * anywhere near argv. Another installer holding the lock → don't race it.

19 */

20export function upgradeToFloor(floor, deps) {

21 if (!isValidVersion(floor) || isPrerelease(floor))

22 return false;

23 if (deps.settings().mode !== "auto")

24 return false;

25 if (!canSelfUpdate(deps.method()))

26 return false;

dist/lib/oauth.js#virtual:normalized:round1View file

310* Windows path deliberately uses `rundll32 url.dll,FileProtocolHandler` rather L311: * than `cmd /c start`, because cmd.exe re-parses its command line and would L312: * interpret `&`, `|`, `^` etc. inside the URL (OAuth query strings always

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L310

dist/rc-proxy.mjsView file

Lines 62-103javascript

62// MNEMOM_AGENT_RC_DOOR gateway door URL (required), e.g. https://gateway.mnemom.ai/anthropic

63// MNEMOM_AGENT_RC_AGENT x-mnemom-agent value (required)

64// MNEMOM_AGENT_RC_CONVERSATION_ID x-mnemom-conversation-id value (required)

65// MNEMOM_AGENT_RC_CONTRACT_B64 base64 contract for x-mnemom-contract (optional)

66// MNEMOM_AGENT_RC_GOAL_MODE x-mnemom-goal-mode value (optional; `--implicit` — no contract,

67// the gateway infers the goal from the user's messages)

68// MNEMOM_AGENT_RC_SESSION_CONFIG x-mnemom-session-config value (optional; per-session env overlay, e.g. context folding off)

69// MNEMOM_AGENT_RC_PROVIDER x-mnemom-provider directive JSON (optional; router door)

70// MNEMOM_AGENT_RC_THREAD_MODE `reject` (default: answer thread-bearing requests locally,

dist/commands/agent.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. l or remote-control shape."); } args = ["remote-control", "--name", rcname, ...passthrough]; if (ctx.handoffmcpconfigpath) args.push("--mcp-config", ctx.handoffmcpconfigpath); say(`mnemom agent: remote-control: headless server (session name '${rcname}'); drive the sessions it spawns from claude.ai/code or the claude app. stop this command to stop the server.`

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/agent.jsView on unpkg

dist/commands/agent-goal.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/agent-goal.js#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged · loading source

dist/lib/update/min-version.jsView file

6*/ L7: import { spawnSync } from "node:child_process"; L8: import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";

High

Child Process

Package source references child process execution.

dist/lib/update/min-version.jsView on unpkg · L6

dist/lib/oauth.js#virtual:normalized:round1View file

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L310

dist/rc-proxy.mjsView file

Findings

6 High2 Medium5 Low

HighChild Processdist/lib/update/min-version.js

HighShelldist/lib/oauth.js#virtual:normalized:round1

HighSame File Env Network Executiondist/rc-proxy.mjs

HighCommand Output Exfiltrationdist/rc-proxy.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/agent.js

HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mnemom/mnemom@0.17.10.

See all versions of @mnemom/mnemom for other recorded verdicts.

Review the evidence and your use of @mnemom/mnemom@0.17.10 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 15:23:51.285Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.