registry / Credential exfiltration / @mnemom/mnemom / 0.17.23

@mnemom/mnemom@0.17.23

Transparent AI agent tracing

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Source inspection confirms that an Anthropic API key is sent to the package’s default Mnemom gateway during the Remote Control API-key flow, without recipient-specific consent. This concrete credential disclosure supports blocking; the manifest does not establish an install-time attack.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Launching the agent through the Remote Control API-key path.

Impact

The gateway receives the Anthropic credential, exposing it to that recipient beyond its intended Anthropic service.

Mechanism

The launcher passes the Anthropic key to a local proxy, which adds it as x-api-key to requests sent to the configured gateway; the default door resolves to gateway.mnemom.ai.

Attack narrative

When the agent uses API-key authentication, its Remote Control launch passes the Anthropic key to a local proxy. The proxy forwards the key in the x-api-key header to the Mnemom gateway, whose default endpoint is gateway.mnemom.ai. This exposes a service credential to the package-selected gateway without a recipient-specific consent gate; the source does not establish how the recipient uses it.

AI rationale

Evidence

dist/commands/agent.jsdist/rc-proxy.mjsdist/lib/agent.js

Network endpoints1

gateway.mnemom.ai

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The agent resolves an Anthropic API key for API-key authentication and passes it to the Remote Control launch.
The launcher sends that key to the proxy over stdin; the proxy puts it in the x-api-key header on requests routed to the gateway.
The gateway door defaults to https://gateway.mnemom.ai, with an override available.
The package manifest has no install hook; its prepublishOnly script only runs the build.

Evidence against

The transfer is part of an agent launch and can use a configured gateway override.
No install-time credential transfer is established.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 107 file(s), 1.27 MB of source, external domains: 127.0.0.1, aap.mnemom.ai, api-us1.mnemom.ai, api.mnemom.ai, claude.com, docs.mnemom.ai, docs.npmjs.com, gateway-us1.mnemom.ai, gateway.mnemom.ai, preview.mnemom.ai, registry.npmjs.org, slack.com, www.mnemom.ai

Source & flagged code

6 flagged

dist/lib/update/min-version.jsView file

Lines 1-26javascript

1/**

2 * Turn the server's minimum-CLI hard-fail (lib/version-gate.ts) into a

3 * one-retry fix: when update.mode is auto and this install can update itself,

4 * install the newest stable release satisfying the floor, in the foreground,

5 * and ask the user to re-run. Synchronous because the gate is.

6 */

7import { spawnSync } from "node:child_process";

8import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";

High

Child Process

Package source references child process execution.

dist/lib/update/min-version.jsView on unpkg · L6

9import { CLI_VERSION } from "../../version.js";

10import { classifyInstall } from "./install-method.js";

11import { isValidVersion, isPrerelease } from "./semver.js";

12import { acquireLock, loadUpdateState } from "./state.js";

13import { entryRealpath, loadUpdatePrefs, npmInvocation } from "./system.js";

14/**

15 * Returns true when the CLI was upgraded. Only in `auto` mode — `notify` means

16 * "never install without my say-so", even for a server floor. The floor is

17 * untrusted header input: it must be a plain release version before it goes

18 * anywhere near argv. Another installer holding the lock → don't race it.

19 */

20export function upgradeToFloor(floor, deps) {

21 if (!isValidVersion(floor) || isPrerelease(floor))

22 return false;

23 if (deps.settings().mode !== "auto")

24 return false;

25 if (!canSelfUpdate(deps.method()))

26 return false;

dist/lib/oauth.js#virtual:normalized:round1View file

272// Still pending (authorization_pending / slow_down) — emit a heartbeat L273: // every ~15s so a multi-minute approval doesn"t look hung.\n if (waitedMs >= nextHeartbeatMs) {\n display(`…still waiting for you to finish signing in (${Math.ro... L274: * validated (https, or http on loopback) and then passed as a separate argv

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L272

dist/rc-proxy.mjsView file

Lines 64-104javascript

64// MNEMOM_AGENT_RC_AGENT x-mnemom-agent value (required)

65// MNEMOM_AGENT_RC_CONVERSATION_ID x-mnemom-conversation-id value (required)

66// MNEMOM_AGENT_RC_CONTRACT_B64 base64 contract for x-mnemom-contract (optional)

67// MNEMOM_AGENT_RC_GOAL_MODE x-mnemom-goal-mode value (optional; `--implicit` — no contract,

68// the gateway infers the goal from the user's messages)

69// MNEMOM_AGENT_RC_SESSION_CONFIG x-mnemom-session-config value (optional; per-session env overlay, e.g. context folding off)

70// MNEMOM_AGENT_RC_PROVIDER x-mnemom-provider directive JSON (optional; router door)

71// MNEMOM_AGENT_RC_THREAD_MODE `reject` (default: answer thread-bearing requests locally,

72// see above) | `strip` (legacy: delete `thread`, forward)

dist/commands/agent-goal.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/agent-goal.js#virtual:normalized:round1View on unpkg

dist/commands/agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mnemom/mnemom@0.17.17 matchedIdentity = npm:QG1uZW1vbS9tbmVtb20:0.17.17 similarity = 0.814 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/agent.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/lib/update/min-version.jsView file

6*/ L7: import { spawnSync } from "node:child_process"; L8: import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";

High

Child Process

Package source references child process execution.

dist/lib/update/min-version.jsView on unpkg · L6

dist/lib/oauth.js#virtual:normalized:round1View file

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L272

dist/rc-proxy.mjsView file

Findings

1 Critical5 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/agent.js

HighChild Processdist/lib/update/min-version.js

HighShelldist/lib/oauth.js#virtual:normalized:round1

HighSame File Env Network Executiondist/rc-proxy.mjs

HighCommand Output Exfiltrationdist/rc-proxy.mjs

HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mnemom/mnemom@0.17.23.

See all versions of @mnemom/mnemom for other recorded verdicts.

Avoid installing @mnemom/mnemom@0.17.23. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-23 00:19:18.532Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other credential exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other credential exfiltration packages