registry / Credential exfiltration / @mnemom/mnemom / 0.17.29

@mnemom/mnemom@0.17.29

Transparent AI agent tracing

AI Security Review

scanned 6h ago · by lpm-firewall-ai

The remote-control path forwards an existing Anthropic API key to a gateway, creating credential exposure dependent on gateway selection. Source inspection did not establish an unrelated recipient, so this warrants a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user launches the agent in remote-control mode.

Impact

The gateway receives the Anthropic API key and can use it to authenticate to Anthropic.

Mechanism

A local proxy redirects Anthropic message requests to the configured HTTPS gateway and forwards the API key in a request header for non-subscription use.

AI rationale

Evidence

dist/commands/agent.jsdist/rc-proxy.mjs

Network endpoints1

gateway.mnemom.ai/anthropic

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit remote-control launch starts a local proxy.
The proxy routes Anthropic message requests to a gateway URL supplied through its environment.
For non-subscription requests, it puts the Anthropic API key in the gateway request’s x-api-key header.
The Slack reply handler passes the bot token and caller-supplied channel and text to postMessage.
The routing handler ignores bot events and events missing a user, channel, or timestamp.

Evidence against

The proxy removes the OAuth bearer from non-subscription requests.
The inspected source does not establish that the gateway URL is unrestricted or controlled by an unrelated recipient.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/rc-certs.mjsView file

Lines 1-37javascript

1// Certificate checks and leaf rotation for the Remote Control MITM proxy (rc-proxy.mjs).

2//

3// The proxy mints its CA and leaf by shelling out to whatever `openssl` is first on PATH. On macOS

4// that is often /usr/bin/openssl (LibreSSL), whose defaults differ from OpenSSL 3's: `x509 -req`

5// signs with SHA-1, and EC keys come out with explicit curve parameters. Node (OpenSSL 3) refuses

6// both — a SHA-1 leaf at https.createServer (ERR_SSL_CA_MD_TOO_WEAK), an explicit-parameter key at

7// the client's chain verification. rc-proxy.mjs pins `-sha256` and `ec_param_enc:named_curve`;

8// this module is the fail-closed check behind that pin, so an openssl that still mints something

9// Node cannot use stops the proxy with a message naming the binary, not a raw Node stack trace.

10//

11// Node 22's X509Certificate has no signatureAlgorithm getter, and it reports `namedCurve` even for

12// an explicit-parameter key, so the two properties are read from the certificate's DER directly.

14import fs from "node:fs";

15import path from "node:path";

16import tls from "node:tls";

17import crypto from "node:crypto";

18import { execFileSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/rc-certs.mjsView on unpkg · L17

20const SIG_ALGS = {

21 "2a8648ce3d0401": "ecdsa-with-SHA1",

22 "2a8648ce3d040301": "ecdsa-with-SHA224",

23 "2a8648ce3d040302": "ecdsa-with-SHA256",

24 "2a8648ce3d040303": "ecdsa-with-SHA384",

25 "2a8648ce3d040304": "ecdsa-with-SHA512",

26 "2a864886f70d010104": "md5WithRSAEncryption",

27 "2a864886f70d010105": "sha1WithRSAEncryption",

28 "2a864886f70d01010b": "sha256WithRSAEncryption",

29 "2a864886f70d01010c": "sha384WithRSAEncryption",

30 "2a864886f70d01010d": "sha512WithRSAEncryption",

31};

32const STRONG_SIG_ALGS = new Set([

33 "ecdsa-with-SHA256",

34 "ecdsa-with-SHA384",

35 "ecdsa-with-SHA512",

36 "sha256WithRSAEncryption",

37 "sha384WithRSAEncryption",

dist/rc-proxy.mjsView file

Lines 67-108javascript

67// Mnemom key on stdin line 2)

68// MNEMOM_AGENT_RC_CONVERSATION_ID x-mnemom-conversation-id value (required)

69// MNEMOM_AGENT_RC_CONTRACT_B64 base64 contract for x-mnemom-contract (optional)

70// MNEMOM_AGENT_RC_GOAL_MODE x-mnemom-goal-mode value (optional; `--implicit` — no contract,

71// the gateway infers the goal from the user's messages)

72// MNEMOM_AGENT_RC_SESSION_CONFIG x-mnemom-session-config value (optional; per-session env overlay, e.g. context folding off)

73// MNEMOM_AGENT_RC_PROVIDER x-mnemom-provider directive JSON (optional; router door)

74// MNEMOM_AGENT_RC_THREAD_MODE `reject` (default: answer thread-bearing requests locally,

75// see above) | `strip` (legacy: delete `thread`, forward)

dist/commands/agent-goal.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/agent-goal.js#virtual:normalized:round1View on unpkg

dist/commands/agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mnemom/mnemom@0.17.17 matchedIdentity = npm:QG1uZW1vbS9tbmVtb20:0.17.17 similarity = 0.686 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/agent.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/rc-certs.mjsView file

17import crypto from "node:crypto"; L18: import { execFileSync } from "node:child_process"; L19:

High

Child Process

Package source references child process execution.

dist/rc-certs.mjsView on unpkg · L17

dist/rc-proxy.mjsView file

87// stdout: exactly one line, `READY <port> <ca.pem path>`, once listening. Node ≥ 18, no deps. L88: import http from "node:http"; L89: import https from "node:https"; ... L94: import crypto from "node:crypto"; L95: import { execFileSync } from "node:child_process"; L96: import { TURN_HEADER, TurnOrigins, turnHeaderEnabled, turnHeaderFor } from "./turn-origin.mjs"; ... L100: const MITM_HOST = "api.anthropic.com"; L101: const env = process.env; L102:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/rc-proxy.mjsView on unpkg · L87

88import http from "node:http"; L89: import https from "node:https"; L90: import net from "node:net"; ... L94: import crypto from "node:crypto"; L95: import { execFileSync } from "node:child_process"; L96: import { TURN_HEADER, TurnOrigins, turnHeaderEnabled, turnHeaderFor } from "./turn-origin.mjs"; ... L103: function die(msg) { L104: process.stderr.write(`mnemom-code-rc-proxy: ${msg}\n`); L105: process.exit(2);

Findings

1 Critical5 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/agent.js

HighChild Processdist/rc-certs.mjs

HighShell

HighSame File Env Network Executiondist/rc-proxy.mjs

HighCommand Output Exfiltrationdist/rc-proxy.mjs

HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mnemom/mnemom@0.17.29.

See all versions of @mnemom/mnemom for other recorded verdicts.

Review the evidence and your use of @mnemom/mnemom@0.17.29 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 00:21:38.853Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code