registry / @remnic/plugin-codex / 9.3.664

@remnic/plugin-codex@9.3.664

Remnic memory plugin for Codex CLI — hooks, skills, MCP integration

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 61.4 KB of source

Source & flagged code

4 flagged

hooks/bin/remnic-codex-hook.cjsView file

Lines 7-48javascript

7 * event name as argv[2]:

8 *

9 * node remnic-codex-hook.cjs <event>

10 *

11 * Events: session-start | user-prompt-recall | post-tool-observe | session-end

12 *

13 * This is a faithful port of the original four bash scripts — same endpoints,

14 * env vars, token resolution, cursor/lock hardening, engram→remnic migration,

15 * daemon health/auto-start, git coding-context projectId derivation, and

16 * session-end memory materialization. Node replaces the per-script `node -e`

17 * one-liners and Unix tools (curl/git/sed/mktemp/…) so the exact same logic

18 * runs on Windows, macOS, and Linux.

19 *

20 * Fail-open everywhere: any unexpected error degrades to `{"continue":true}`.

21 */

23"use strict";

25const fs = require("fs");

26const os = require("os");

27const path = require("path");

28const http = require("http");

29const { execFileSync, spawn, spawnSync } = require("child_process");

High

Child Process

Package source references child process execution.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L28

31const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir();

32const HOST = process.env.REMNIC_HOST || process.env.ENGRAM_HOST || "127.0.0.1";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L27

33const PORT = process.env.REMNIC_PORT || process.env.ENGRAM_PORT || "4318";

35// Internal re-entrant mode: post-tool-observe spawns a detached copy of itself

36// so the (slow) observe runs in the background and never blocks Codex past the

37// short PostToolUse timeout — mirroring the original `( … ) & disown`.

38const OBSERVE_WORKER = "__observe-worker__";

40const LOG_FILES = {

41 "session-start": "remnic-session-recall.log",

42 "user-prompt-recall": "remnic-user-prompt-recall.log",

43 "post-tool-observe": "remnic-post-tool-observe.log",

44 "session-end": "remnic-codex-session-end.log",

45};

46const LOG_TAGS = {

47 "session-start": "codex-session-start",

48 "user-prompt-recall": "codex-user-prompt",

Lines 873-913javascript

873 }

874 } catch {

875 /* ignore */

876 }

877 }

878

879 // Force HOME to the home dir the runner resolved (HOME → USERPROFILE →

880 // os.homedir()). The materializer resolves config paths from HOME and only

881 // falls back to os.homedir(); on Windows, where HOME is typically unset,

882 // passing it explicitly guarantees the child uses the SAME home as the hook

883 // instead of diverging (#1443 review).

hooks/bin/remnic-codex-hook.ps1View file

•path = hooks/bin/remnic-codex-hook.ps1 kind = build_helper sizeBytes = 525 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/bin/remnic-codex-hook.ps1View on unpkg

Source & flagged code

4 flagged · loading source

hooks/bin/remnic-codex-hook.cjsView file

28const http = require("http"); L29: const { execFileSync, spawn, spawnSync } = require("child_process"); L30:

High

Child Process

Package source references child process execution.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L28

27const path = require("path"); L28: const http = require("http"); L29: const { execFileSync, spawn, spawnSync } = require("child_process"); L30: L31: const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir(); L32: const HOST = process.env.REMNIC_HOST || process.env.ENGRAM_HOST || "127.0.0.1";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L27

893} else if (repoRoot) { L894: const r = spawnSync("npx", ["--yes", "tsx", "scripts/codex-materialize.ts", "--reason", "session_end"], { L895: cwd: repoRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L893

hooks/bin/remnic-codex-hook.ps1View file

•path = hooks/bin/remnic-codex-hook.ps1 kind = build_helper sizeBytes = 525 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/bin/remnic-codex-hook.ps1View on unpkg

Findings

3 High4 Medium2 Low

HighChild Processhooks/bin/remnic-codex-hook.cjs

HighSame File Env Network Executionhooks/bin/remnic-codex-hook.cjs

HighRuntime Package Installhooks/bin/remnic-codex-hook.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperhooks/bin/remnic-codex-hook.ps1

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

hooks/bin/remnic-codex-hook.cjsView file

Lines 7-48javascript

7 * event name as argv[2]:

8 *

9 * node remnic-codex-hook.cjs <event>

10 *

11 * Events: session-start | user-prompt-recall | post-tool-observe | session-end

12 *

13 * This is a faithful port of the original four bash scripts — same endpoints,

14 * env vars, token resolution, cursor/lock hardening, engram→remnic migration,

15 * daemon health/auto-start, git coding-context projectId derivation, and

16 * session-end memory materialization. Node replaces the per-script `node -e`

17 * one-liners and Unix tools (curl/git/sed/mktemp/…) so the exact same logic

18 * runs on Windows, macOS, and Linux.

19 *

20 * Fail-open everywhere: any unexpected error degrades to `{"continue":true}`.

21 */

23"use strict";

25const fs = require("fs");

26const os = require("os");

27const path = require("path");

28const http = require("http");

29const { execFileSync, spawn, spawnSync } = require("child_process");

High

Child Process

Package source references child process execution.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L28

31const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir();

32const HOST = process.env.REMNIC_HOST || process.env.ENGRAM_HOST || "127.0.0.1";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L27

33const PORT = process.env.REMNIC_PORT || process.env.ENGRAM_PORT || "4318";

35// Internal re-entrant mode: post-tool-observe spawns a detached copy of itself

36// so the (slow) observe runs in the background and never blocks Codex past the

37// short PostToolUse timeout — mirroring the original `( … ) & disown`.

38const OBSERVE_WORKER = "__observe-worker__";

40const LOG_FILES = {

41 "session-start": "remnic-session-recall.log",

42 "user-prompt-recall": "remnic-user-prompt-recall.log",

43 "post-tool-observe": "remnic-post-tool-observe.log",

44 "session-end": "remnic-codex-session-end.log",

45};

46const LOG_TAGS = {

47 "session-start": "codex-session-start",

48 "user-prompt-recall": "codex-user-prompt",

Lines 873-913javascript

873 }

874 } catch {

875 /* ignore */

876 }

877 }

878

879 // Force HOME to the home dir the runner resolved (HOME → USERPROFILE →

880 // os.homedir()). The materializer resolves config paths from HOME and only

881 // falls back to os.homedir(); on Windows, where HOME is typically unset,

882 // passing it explicitly guarantees the child uses the SAME home as the hook

883 // instead of diverging (#1443 review).

hooks/bin/remnic-codex-hook.ps1View file

•path = hooks/bin/remnic-codex-hook.ps1 kind = build_helper sizeBytes = 525 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/bin/remnic-codex-hook.ps1View on unpkg