@mnemom/mnemom@0.17.3
Transparent AI agent tracing
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe default permission bypass is a real, user-triggered dangerous capability that warrants a warning. The remaining flagged behavior inspected is consistent with package features, and no concrete malicious behavior was established.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the agent-launch command without opting out of the default mode.
Impact
The launched agent may perform actions without its normal permission checks; no separate malicious action was established in the inspected source.
Mechanism
The launcher appends the coding agent’s permission-bypass flag to its command-line arguments.
AI rationale
The default permission bypass is a real, user-triggered dangerous capability that warrants a warning. The remaining flagged behavior inspected is consistent with package features, and no concrete malicious behavior was established.
Evidence
dist/commands/agent.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has only a prepublish build hook; no install-time lifecycle hook was identified.
- The agent launcher documents permission bypass as on by default with an opt-out, and adds the bypass flag to the launched CLI arguments.
- The launcher starts the selected coding-agent executable directly with inherited standard I/O.
- The remote-control proxy requires an HTTPS gateway and invokes OpenSSL to create its local TLS certificates.
- Self-update requires automatic update mode and a supported installation method.
Evidence against
- The inspected flagged behavior is tied to the package’s agent-launch and remote-control features; no concrete credential theft, unrelated control-surface mutation, or other attack chain was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/lib/update/min-version.jsView file
6*/
L7: import { spawnSync } from "node:child_process";
L8: import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";
High
Child Process
Package source references child process execution.
dist/lib/update/min-version.jsView on unpkg · L6dist/rc-proxy.mjsView file
76// stdout: exactly one line, `READY <port> <ca.pem path>`, once listening. Node ≥ 18, no deps.
L77: import http from "node:http";
L78: import https from "node:https";
...
L83: import crypto from "node:crypto";
L84: import { execFileSync } from "node:child_process";
L85:
L86: const MITM_HOST = "api.anthropic.com";
L87: const env = process.env;
L88:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/rc-proxy.mjsView on unpkg · L7675//
L76: // stdout: exactly one line, `READY <port> <ca.pem path>`, once listening. Node ≥ 18, no deps.
L77: import http from "node:http";
L78: import https from "node:https";
...
L83: import crypto from "node:crypto";
L84: import { execFileSync } from "node:child_process";
L85:
...
L89: function die(msg) {
L90: process.stderr.write(`mnemom-code-rc-proxy: ${msg}\n`);
L91: process.exit(2);
Findings
5 High2 Medium5 Low
HighChild Processdist/lib/update/min-version.js
HighSame File Env Network Executiondist/rc-proxy.mjs
HighCommand Output Exfiltrationdist/rc-proxy.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/agent.js
HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mnemom/mnemom@0.17.3.
See all versions of @mnemom/mnemom for other recorded verdicts.
- Review the evidence and your use of @mnemom/mnemom@0.17.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.