registry / @mnemom/mnemom / 0.17.26
@mnemom/mnemom@0.17.26
Transparent AI agent tracing
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe package has no install-time execution hook, and the inspected network and process behaviors are tied to its user-invoked CLI product functions. The default permission bypass is a meaningful safety risk, but the reviewed source does not establish a package attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the agent launcher, with remote-control behavior used when selected.
Impact
The launcher can perform agent actions without Claude Code permission prompts when yolo mode is active. The inspected source does not establish independent execution or malicious behavior.
Mechanism
The proxy routes Anthropic message requests to the Mnemom gateway; the certificate helper uses OpenSSL to create proxy certificates. The launcher also defaults to skipping Claude Code permission checks.
AI rationale
The package has no install-time execution hook, and the inspected network and process behaviors are tied to its user-invoked CLI product functions. The default permission bypass is a meaningful safety risk, but the reviewed source does not establish a package attack.
Evidence
package.jsondist/rc-proxy.mjsdist/rc-certs.mjsdist/commands/agent.jsdist/lib/slack-channel.js
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a prepublishOnly build hook; it has no install-time hook.
- The Slack runtime hint formats an inbox message as a notification and returns it without a network send.
- The inspected policy engine exports policy evaluation helpers, while chalk and commander provide terminal styling and CLI parsing.
- The reviewed runtime modules describe user-invoked CLI functions for session, goal, export, identity, skill, and handoff operations.
- The remote-control proxy is part of the agent launcher: it rewrites Anthropic message requests to the Mnemom gateway, and the launcher documents that yolo mode is enabled by default.
Evidence against
- The default yolo setting skips Claude Code permission checks, which increases the risk of user-invoked agent actions. The inspected source does not show this being activated independently of the launcher.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flagged · loading sourcedist/rc-certs.mjsView file
17import crypto from "node:crypto";
L18: import { execFileSync } from "node:child_process";
L19:
High
dist/rc-proxy.mjsView file
87// stdout: exactly one line, `READY <port> <ca.pem path>`, once listening. Node ≥ 18, no deps.
L88: import http from "node:http";
L89: import https from "node:https";
...
L94: import crypto from "node:crypto";
L95: import { execFileSync } from "node:child_process";
L96: import { TURN_HEADER, TurnOrigins, turnHeaderEnabled, turnHeaderFor } from "./turn-origin.mjs";
...
L100: const MITM_HOST = "api.anthropic.com";
L101: const env = process.env;
L102:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/rc-proxy.mjsView on unpkg · L8788import http from "node:http";
L89: import https from "node:https";
L90: import net from "node:net";
...
L94: import crypto from "node:crypto";
L95: import { execFileSync } from "node:child_process";
L96: import { TURN_HEADER, TurnOrigins, turnHeaderEnabled, turnHeaderFor } from "./turn-origin.mjs";
...
L103: function die(msg) {
L104: process.stderr.write(`mnemom-code-rc-proxy: ${msg}\n`);
L105: process.exit(2);
Findings
1 Critical5 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/agent.js
HighChild Processdist/rc-certs.mjs
HighShell
HighSame File Env Network Executiondist/rc-proxy.mjs
HighCommand Output Exfiltrationdist/rc-proxy.mjs
HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mnemom/mnemom@0.17.26.
See all versions of @mnemom/mnemom for other recorded verdicts.
- Review the evidence and your use of @mnemom/mnemom@0.17.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.