@mnemom/mnemom@0.17.27

Transparent AI agent tracing

AI Security Review

scanned 6h ago · by lpm-firewall-ai

Source inspection resolves the flagged proxy and child-process behavior as user-invoked gateway routing and certificate validation. The manifest has no install-time hook, and the inspected sources establish no concrete attack behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The proxy starts when the user invokes the agent with Remote Control enabled.

Impact

The inspected behavior supports the agent gateway feature and does not establish covert credential theft, unrequested account changes, or install-time mutation.

Mechanism

It locally intercepts the Anthropic API host and forwards message requests to the configured HTTPS gateway; OAuth authorization is removed from the forwarded request.

AI rationale

Evidence

package.jsondist/commands/agent.jsdist/rc-proxy.mjsdist/rc-certs.mjs

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes CLI binaries and only a prepublishOnly build hook; it has no automatic install hook.
The reviewed CLI, session, policy, export, skills, identity, and handoff sources describe user-facing operations or an off-by-default handoff tool; the inspected dependency entrypoints are ordinary library exports.
The Remote Control proxy is started for an explicit --remote-control launch. Its caller sends secrets to the local proxy over stdin and refuses to launch the agent if the proxy does not become ready.
The proxy handles api.anthropic.com traffic to the configured HTTPS gateway, forwards the Anthropic API key for API-key sessions, and removes the OAuth bearer. This matches the package’s agent-gateway routing behavior.
The flagged certificate helper invokes openssl to report its version and validate generated certificates; the inspected operation does not send command output over the network.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Source & flagged code

5 flagged

dist/rc-certs.mjsView file

Lines 1-37javascript

1// Certificate checks and leaf rotation for the Remote Control MITM proxy (rc-proxy.mjs).

2//

3// The proxy mints its CA and leaf by shelling out to whatever `openssl` is first on PATH. On macOS

4// that is often /usr/bin/openssl (LibreSSL), whose defaults differ from OpenSSL 3's: `x509 -req`

5// signs with SHA-1, and EC keys come out with explicit curve parameters. Node (OpenSSL 3) refuses

6// both — a SHA-1 leaf at https.createServer (ERR_SSL_CA_MD_TOO_WEAK), an explicit-parameter key at

7// the client's chain verification. rc-proxy.mjs pins `-sha256` and `ec_param_enc:named_curve`;

8// this module is the fail-closed check behind that pin, so an openssl that still mints something

9// Node cannot use stops the proxy with a message naming the binary, not a raw Node stack trace.

10//

11// Node 22's X509Certificate has no signatureAlgorithm getter, and it reports `namedCurve` even for

12// an explicit-parameter key, so the two properties are read from the certificate's DER directly.

14import fs from "node:fs";

15import path from "node:path";

16import tls from "node:tls";

17import crypto from "node:crypto";

18import { execFileSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/rc-certs.mjsView on unpkg · L17

20const SIG_ALGS = {

21 "2a8648ce3d0401": "ecdsa-with-SHA1",

22 "2a8648ce3d040301": "ecdsa-with-SHA224",

23 "2a8648ce3d040302": "ecdsa-with-SHA256",

24 "2a8648ce3d040303": "ecdsa-with-SHA384",

25 "2a8648ce3d040304": "ecdsa-with-SHA512",

26 "2a864886f70d010104": "md5WithRSAEncryption",

27 "2a864886f70d010105": "sha1WithRSAEncryption",

28 "2a864886f70d01010b": "sha256WithRSAEncryption",

29 "2a864886f70d01010c": "sha384WithRSAEncryption",

30 "2a864886f70d01010d": "sha512WithRSAEncryption",

31};

32const STRONG_SIG_ALGS = new Set([

33 "ecdsa-with-SHA256",

34 "ecdsa-with-SHA384",

35 "ecdsa-with-SHA512",

36 "sha256WithRSAEncryption",

37 "sha384WithRSAEncryption",

dist/rc-proxy.mjsView file

Lines 67-108javascript

67// Mnemom key on stdin line 2)

68// MNEMOM_AGENT_RC_CONVERSATION_ID x-mnemom-conversation-id value (required)

69// MNEMOM_AGENT_RC_CONTRACT_B64 base64 contract for x-mnemom-contract (optional)

70// MNEMOM_AGENT_RC_GOAL_MODE x-mnemom-goal-mode value (optional; `--implicit` — no contract,

71// the gateway infers the goal from the user's messages)

72// MNEMOM_AGENT_RC_SESSION_CONFIG x-mnemom-session-config value (optional; per-session env overlay, e.g. context folding off)

73// MNEMOM_AGENT_RC_PROVIDER x-mnemom-provider directive JSON (optional; router door)

74// MNEMOM_AGENT_RC_THREAD_MODE `reject` (default: answer thread-bearing requests locally,

75// see above) | `strip` (legacy: delete `thread`, forward)

dist/commands/agent-goal.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/agent-goal.js#virtual:normalized:round1View on unpkg

dist/commands/agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mnemom/mnemom@0.17.17 matchedIdentity = npm:QG1uZW1vbS9tbmVtb20:0.17.17 similarity = 0.696 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/agent.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/rc-certs.mjsView file

17import crypto from "node:crypto"; L18: import { execFileSync } from "node:child_process"; L19:

High

Child Process

Package source references child process execution.

dist/rc-certs.mjsView on unpkg · L17

dist/rc-proxy.mjsView file

87// stdout: exactly one line, `READY <port> <ca.pem path>`, once listening. Node ≥ 18, no deps. L88: import http from "node:http"; L89: import https from "node:https"; ... L94: import crypto from "node:crypto"; L95: import { execFileSync } from "node:child_process"; L96: import { TURN_HEADER, TurnOrigins, turnHeaderEnabled, turnHeaderFor } from "./turn-origin.mjs"; ... L100: const MITM_HOST = "api.anthropic.com"; L101: const env = process.env; L102:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/rc-proxy.mjsView on unpkg · L87

88import http from "node:http"; L89: import https from "node:https"; L90: import net from "node:net"; ... L94: import crypto from "node:crypto"; L95: import { execFileSync } from "node:child_process"; L96: import { TURN_HEADER, TurnOrigins, turnHeaderEnabled, turnHeaderFor } from "./turn-origin.mjs"; ... L103: function die(msg) { L104: process.stderr.write(`mnemom-code-rc-proxy: ${msg}\n`); L105: process.exit(2);

Findings

1 Critical5 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/agent.js

HighChild Processdist/rc-certs.mjs

HighShell

HighSame File Env Network Executiondist/rc-proxy.mjs

HighCommand Output Exfiltrationdist/rc-proxy.mjs

HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mnemom/mnemom@0.17.27.

See all versions of @mnemom/mnemom for other recorded verdicts.

Review the evidence and your use of @mnemom/mnemom@0.17.27 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 00:21:54.720Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.