registry / AI-agent capability abuse / @mnemom/mnemom / 0.17.25

@mnemom/mnemom@0.17.25

Transparent AI agent tracing

AI Security Review

scanned 6h ago · by lpm-firewall-ai

The default permission bypass is a risky agent capability, but the package discloses it and offers an opt-out. I found no source evidence establishing malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs the mnemom agent command without disabling yolo mode.

Impact

Agent actions may run without permission prompts; users can keep prompts by selecting --no-yolo.

Mechanism

The launcher adds Claude Code's permission-skipping command-line flag.

AI rationale

The default permission bypass is a risky agent capability, but the package discloses it and offers an opt-out. I found no source evidence establishing malicious behavior.

Evidence

dist/commands/agent.jsdist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The launcher enables permission skipping by default.
When enabled, the launcher passes Claude Code the flag that skips permission checks.
The command exposes --no-yolo as an opt-out and says that it keeps permission prompts.
The launcher warns that permission prompts are skipped and explains how to keep them.
The slack_reply handler passes the session bot token, caller-supplied channel, and caller-supplied text to postMessage.

Evidence against

The permission-skipping behavior is disclosed to users and can be disabled with --no-yolo.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 108 file(s), 1.28 MB of source, external domains: 127.0.0.1, aap.mnemom.ai, api-us1.mnemom.ai, api.mnemom.ai, claude.com, docs.mnemom.ai, docs.npmjs.com, gateway-us1.mnemom.ai, gateway.mnemom.ai, preview.mnemom.ai, registry.npmjs.org, slack.com, www.mnemom.ai

Source & flagged code

6 flagged

dist/rc-certs.mjsView file

Lines 1-37javascript

1// Certificate checks and leaf rotation for the Remote Control MITM proxy (rc-proxy.mjs).

2//

3// The proxy mints its CA and leaf by shelling out to whatever `openssl` is first on PATH. On macOS

4// that is often /usr/bin/openssl (LibreSSL), whose defaults differ from OpenSSL 3's: `x509 -req`

5// signs with SHA-1, and EC keys come out with explicit curve parameters. Node (OpenSSL 3) refuses

6// both — a SHA-1 leaf at https.createServer (ERR_SSL_CA_MD_TOO_WEAK), an explicit-parameter key at

7// the client's chain verification. rc-proxy.mjs pins `-sha256` and `ec_param_enc:named_curve`;

8// this module is the fail-closed check behind that pin, so an openssl that still mints something

9// Node cannot use stops the proxy with a message naming the binary, not a raw Node stack trace.

10//

11// Node 22's X509Certificate has no signatureAlgorithm getter, and it reports `namedCurve` even for

12// an explicit-parameter key, so the two properties are read from the certificate's DER directly.

14import fs from "node:fs";

15import path from "node:path";

16import tls from "node:tls";

17import crypto from "node:crypto";

18import { execFileSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/rc-certs.mjsView on unpkg · L17

20const SIG_ALGS = {

21 "2a8648ce3d0401": "ecdsa-with-SHA1",

22 "2a8648ce3d040301": "ecdsa-with-SHA224",

23 "2a8648ce3d040302": "ecdsa-with-SHA256",

24 "2a8648ce3d040303": "ecdsa-with-SHA384",

25 "2a8648ce3d040304": "ecdsa-with-SHA512",

26 "2a864886f70d010104": "md5WithRSAEncryption",

27 "2a864886f70d010105": "sha1WithRSAEncryption",

28 "2a864886f70d01010b": "sha256WithRSAEncryption",

29 "2a864886f70d01010c": "sha384WithRSAEncryption",

30 "2a864886f70d01010d": "sha512WithRSAEncryption",

31};

32const STRONG_SIG_ALGS = new Set([

33 "ecdsa-with-SHA256",

34 "ecdsa-with-SHA384",

35 "ecdsa-with-SHA512",

36 "sha256WithRSAEncryption",

37 "sha384WithRSAEncryption",

dist/lib/oauth.js#virtual:normalized:round1View file

272// Still pending (authorization_pending / slow_down) — emit a heartbeat L273: // every ~15s so a multi-minute approval doesn"t look hung.\n if (waitedMs >= nextHeartbeatMs) {\n display(`…still waiting for you to finish signing in (${Math.ro... L274: * validated (https, or http on loopback) and then passed as a separate argv

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L272

dist/rc-proxy.mjsView file

Lines 64-105javascript

64// MNEMOM_AGENT_RC_AGENT x-mnemom-agent value (required)

65// MNEMOM_AGENT_RC_CONVERSATION_ID x-mnemom-conversation-id value (required)

66// MNEMOM_AGENT_RC_CONTRACT_B64 base64 contract for x-mnemom-contract (optional)

67// MNEMOM_AGENT_RC_GOAL_MODE x-mnemom-goal-mode value (optional; `--implicit` — no contract,

68// the gateway infers the goal from the user's messages)

69// MNEMOM_AGENT_RC_SESSION_CONFIG x-mnemom-session-config value (optional; per-session env overlay, e.g. context folding off)

70// MNEMOM_AGENT_RC_PROVIDER x-mnemom-provider directive JSON (optional; router door)

71// MNEMOM_AGENT_RC_THREAD_MODE `reject` (default: answer thread-bearing requests locally,

72// see above) | `strip` (legacy: delete `thread`, forward)

dist/commands/agent-goal.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/agent-goal.js#virtual:normalized:round1View on unpkg

dist/commands/agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mnemom/mnemom@0.17.17 matchedIdentity = npm:QG1uZW1vbS9tbmVtb20:0.17.17 similarity = 0.804 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/agent.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/rc-certs.mjsView file

17import crypto from "node:crypto"; L18: import { execFileSync } from "node:child_process"; L19:

High

Child Process

Package source references child process execution.

dist/rc-certs.mjsView on unpkg · L17

dist/lib/oauth.js#virtual:normalized:round1View file

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L272

dist/rc-proxy.mjsView file

Findings

1 Critical5 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/agent.js

HighChild Processdist/rc-certs.mjs

HighShelldist/lib/oauth.js#virtual:normalized:round1

HighSame File Env Network Executiondist/rc-proxy.mjs

HighCommand Output Exfiltrationdist/rc-proxy.mjs

HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mnemom/mnemom@0.17.25.

See all versions of @mnemom/mnemom for other recorded verdicts.

Review the evidence and your use of @mnemom/mnemom@0.17.25 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 00:20:21.820Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code