@mnemonik/cli@7.156.2
Mnemonik installer and local project helper
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe install reporter can send a saved bearer to an unrestricted environment-configured origin, so conditional credential exposure warrants a warning. The default destination is package-aligned, and the other flagged dynamic evaluation occurs in WebAssembly loader glue rather than proving a separate attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the install journey while a saved bearer is available and MNEMONIK_API_RESOURCE is set to an alternate origin.
Impact
A token could be exposed to an operator-configured endpoint. The source does not establish an actual external recipient or token theft.
Mechanism
The reporter places the bearer in an Authorization header on readiness requests and does not enforce an origin allowlist.
AI rationale
The install reporter can send a saved bearer to an unrestricted environment-configured origin, so conditional credential exposure warrants a warning. The default destination is package-aligned, and the other flagged dynamic evaluation occurs in WebAssembly loader glue rather than proving a separate attack.
Evidence
dist/auth/index.jsdist/install/journey.js
Network endpoints1
api.mnemonik.dev
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has no npm lifecycle scripts, so this behavior is not triggered by package installation hooks.
- The CLI API resource can be overridden with MNEMONIK_API_RESOURCE; getCliBearer reads a saved CLI OAuth access token.
- The install readiness reporter obtains that bearer and sends it in an authorization header with readiness data.
- The reporter runs after installation success or failure and uses the configured API origin; the default is api.mnemonik.dev, with no destination allowlist in this path.
- A separate hook request helper takes its server, token, and body as arguments; the inspected code does not show it sourcing saved credentials.
- The eval findings occur in WebAssembly loader glue that builds functions from module-provided bodies; they do not establish remote JavaScript execution.
Evidence against
- The package has no lifecycle scripts; the credential transfer is in the user-invoked install journey.
- The default report destination is the package’s Mnemonik API; exposure depends on configuring an alternate API resource.
- The flagged eval call is in a generated WebAssembly module loader, not evidence that a remote JavaScript response is executed.
Source & flagged code
8 flaggeddist/diagnostics.jsView file
923import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify as verifySignature } from "node:crypto";
L924: import { execFile, execFileSync } from "node:child_process";
L925: function windowsCommand(file) {
High
Child Process
Package source references child process execution.
dist/diagnostics.jsView on unpkg · L9235256var func = `(${args}) => { ${body} };`;
L5257: ASM_CONSTS[start] = eval(func);
L5258: }
High
1import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
L2: var __create = Object.create;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/diagnostics.jsView on unpkg · L1Findings
1 Critical6 High4 Medium4 Low
CriticalRemote Response Code Executiondist/scanner/service.js
HighChild Processdist/diagnostics.js
HighEvaldist/diagnostics.js
HighSame File Env Network Executiondist/install/journey.js
HighCommand Output Exfiltrationdist/runtime/signers.js
HighSandbox Evasion Gated Capabilitydist/install/journey.js
HighCross File Remote Execution Contextdist/auth/credentials.js
MediumDynamic Requiredist/diagnostics.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @mnemonik/cli@7.156.2.
See all versions of @mnemonik/cli for other recorded verdicts.
- Review the evidence and your use of @mnemonik/cli@7.156.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.