registry / @mnemonik/cli / 7.139.2
@mnemonik/cli@7.139.2
Mnemonik installer and local project helper
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe package has no npm install hook, but its explicit setup command can install persistent first-party agent hooks, a capability covered by the warning policy. The reviewed source does not show unconsented installation or concrete malicious hook behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs `mnemonik install` and selects an agent host and hooks; automated setup requires explicit acceptance and apply flags.
Impact
The installed hooks can run within the selected agent’s lifecycle with their component credential; no harmful action by those hooks was established from this package snapshot.
Mechanism
The selected host adapter plans and commits hook-profile changes. Hook setup can obtain and save a component credential through the configured Mnemonik API.
AI rationale
The package has no npm install hook, but its explicit setup command can install persistent first-party agent hooks, a capability covered by the warning policy. The reviewed source does not show unconsented installation or concrete malicious hook behavior.
Evidence
package.jsondist/router.jsdist/install/journey.jsdist/install/hosts.js
Network endpoints1
api.mnemonik.dev
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI and has no npm lifecycle scripts.
- The install command leads into a setup flow that requires explicit host and component choices and, for automatic setup, acceptance and apply flags.
- The interactive flow offers agent-host choices and requires an explicit install confirmation.
- Selected host adapters can plan and commit persistent hook-profile changes; hook setup can also request and store a component credential.
- The flagged agent-integration locations are scanner ignore rules for selected agent worktree data, not configuration writes.
Evidence against
- The setup is user-invoked, and the source requires review or explicit flags before applying it.
- The updater checks the release against a signed manifest before installing it; the inspected source does not establish malicious hook behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
7 flaggeddist/diagnostics.jsView file
898import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify as verifySignature } from "node:crypto";
L899: import { execFile, execFileSync } from "node:child_process";
L900: function windowsCommand(file) {
High
Child Process
Package source references child process execution.
dist/diagnostics.jsView on unpkg · L8985213var func = `(${args}) => { ${body} };`;
L5214: ASM_CONSTS[start] = eval(func);
L5215: }
High
1import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
L2: var __create = Object.create;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/diagnostics.jsView on unpkg · L1Findings
1 Critical5 High4 Medium4 Low
CriticalRemote Response Code Executiondist/runtime/selfUpdate.js
HighChild Processdist/diagnostics.js
HighEvaldist/diagnostics.js
HighSame File Env Network Executiondist/install/journey.js
HighSandbox Evasion Gated Capabilitydist/install/journey.js
HighCross File Remote Execution Contextdist/auth/credentials.js
MediumDynamic Requiredist/diagnostics.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @mnemonik/cli@7.139.2.
See all versions of @mnemonik/cli for other recorded verdicts.
- Review the evidence and your use of @mnemonik/cli@7.139.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.