@mnemom/mnemom@0.17.20

Transparent AI agent tracing

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The manifest has no install-time execution hook, and the inspected runtime behavior is consistent with the package’s CLI features. The scanner signals do not establish unconsented configuration changes, credential exfiltration, or another attack.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The agent launcher, statusline, update, OAuth, and proxy functionality runs when invoked by the user or the coding-agent CLI.

Impact

No concrete malicious effect was identified.

Mechanism

The inspected code reads statusline settings, conditionally updates the CLI in auto mode, opens the OAuth URL without a shell, and creates a local proxy certificate.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines prepublishOnly as a build command and has no install lifecycle hook.
Agent setup is entered through the explicit mnemom agent command; statusline configuration is read from settings files.
Slack channel code formats inbox messages for delivery to the agent session.
Automatic version upgrades require auto mode, a valid stable version, and an update-capable install.
OAuth opens a browser without a shell; the RC proxy uses OpenSSL to create its local certificate.
The agent-goal module describes injected dependencies and imports session-reading functionality.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 102 file(s), 1.18 MB of source, external domains: 127.0.0.1, aap.mnemom.ai, api-staging.mnemom.ai, api-us1.mnemom.ai, api.mnemom.ai, claude.com, docs.mnemom.ai, docs.npmjs.com, gateway-staging.mnemom.ai, gateway-us1.mnemom.ai, gateway.mnemom.ai, preview.mnemom.ai, registry.npmjs.org, slack.com, staging.mnemom.ai, www.mnemom.ai

Source & flagged code

7 flagged

dist/lib/update/min-version.jsView file

Lines 1-26javascript

1/**

2 * Turn the server's minimum-CLI hard-fail (lib/version-gate.ts) into a

3 * one-retry fix: when update.mode is auto and this install can update itself,

4 * install the newest stable release satisfying the floor, in the foreground,

5 * and ask the user to re-run. Synchronous because the gate is.

6 */

7import { spawnSync } from "node:child_process";

8import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";

High

Child Process

Package source references child process execution.

dist/lib/update/min-version.jsView on unpkg · L6

9import { CLI_VERSION } from "../../version.js";

10import { classifyInstall } from "./install-method.js";

11import { isValidVersion, isPrerelease } from "./semver.js";

12import { acquireLock, loadUpdateState } from "./state.js";

13import { entryRealpath, loadUpdatePrefs, npmInvocation } from "./system.js";

14/**

15 * Returns true when the CLI was upgraded. Only in `auto` mode — `notify` means

16 * "never install without my say-so", even for a server floor. The floor is

17 * untrusted header input: it must be a plain release version before it goes

18 * anywhere near argv. Another installer holding the lock → don't race it.

19 */

20export function upgradeToFloor(floor, deps) {

21 if (!isValidVersion(floor) || isPrerelease(floor))

22 return false;

23 if (deps.settings().mode !== "auto")

24 return false;

25 if (!canSelfUpdate(deps.method()))

26 return false;

dist/lib/oauth.js#virtual:normalized:round1View file

272// Still pending (authorization_pending / slow_down) — emit a heartbeat L273: // every ~15s so a multi-minute approval doesn"t look hung.\n if (waitedMs >= nextHeartbeatMs) {\n display(`…still waiting for you to finish signing in (${Math.ro... L274: * validated (https, or http on loopback) and then passed as a separate argv

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L272

dist/rc-proxy.mjsView file

Lines 62-103javascript

62// MNEMOM_AGENT_RC_DOOR gateway door URL (required), e.g. https://gateway.mnemom.ai/anthropic

63// MNEMOM_AGENT_RC_AGENT x-mnemom-agent value (required)

64// MNEMOM_AGENT_RC_CONVERSATION_ID x-mnemom-conversation-id value (required)

65// MNEMOM_AGENT_RC_CONTRACT_B64 base64 contract for x-mnemom-contract (optional)

66// MNEMOM_AGENT_RC_GOAL_MODE x-mnemom-goal-mode value (optional; `--implicit` — no contract,

67// the gateway infers the goal from the user's messages)

68// MNEMOM_AGENT_RC_SESSION_CONFIG x-mnemom-session-config value (optional; per-session env overlay, e.g. context folding off)

69// MNEMOM_AGENT_RC_PROVIDER x-mnemom-provider directive JSON (optional; router door)

70// MNEMOM_AGENT_RC_THREAD_MODE `reject` (default: answer thread-bearing requests locally,

dist/commands/agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mnemom/mnemom@0.17.17 matchedIdentity = npm:QG1uZW1vbS9tbmVtb20:0.17.17 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/agent.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. x.plugin) appendplugindirsenv(childenv, ctx.plugin.dir); if (ctx.handoffmcpconfigpath) args.push("--mcp-config", ctx.handoffmcpconfigpath); say(`mnemom agent: remote-control: headless server (session name '${rcname}'); drive the sessions it spawns from claude.ai/code or the claude app. stop this command to stop the server.`); } else {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/agent.jsView on unpkg

dist/commands/agent-goal.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/agent-goal.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged · loading source

dist/lib/update/min-version.jsView file

6*/ L7: import { spawnSync } from "node:child_process"; L8: import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";

High

Child Process

Package source references child process execution.

dist/lib/update/min-version.jsView on unpkg · L6

dist/lib/oauth.js#virtual:normalized:round1View file

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L272

dist/rc-proxy.mjsView file

Findings

1 Critical6 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/agent.js

HighChild Processdist/lib/update/min-version.js

HighShelldist/lib/oauth.js#virtual:normalized:round1

HighSame File Env Network Executiondist/rc-proxy.mjs

HighCommand Output Exfiltrationdist/rc-proxy.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/agent.js

HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @mnemom/mnemom@0.17.20.

See all versions of @mnemom/mnemom for other recorded verdicts.

Review the evidence and your use of @mnemom/mnemom@0.17.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 13:02:55.698Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.