registry / @remnic/plugin-codex / 9.3.694

@remnic/plugin-codex@9.3.694

Remnic memory plugin for Codex CLI — hooks, skills, MCP integration

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 98.3 KB of source, external domains: 127.0.0.1

Source & flagged code

4 flagged

hooks/bin/remnic-codex-hook.cjsView file

Lines 7-49javascript

7 * event name as argv[2]:

8 *

9 * node remnic-codex-hook.cjs <event>

10 *

11 * Events: session-start | user-prompt-recall | post-tool-observe | session-end

12 *

13 * This is a faithful port of the original four bash scripts — same endpoints,

14 * env vars, token resolution, cursor/lock hardening, engram→remnic migration,

15 * daemon health/auto-start, git coding-context projectId derivation, and

16 * session-end memory materialization. Node replaces the per-script `node -e`

17 * one-liners and Unix tools (curl/git/sed/mktemp/…) so the exact same logic

18 * runs on Windows, macOS, and Linux.

19 *

20 * Fail-open everywhere: any unexpected error degrades to `{"continue":true}`.

21 */

23"use strict";

25const fs = require("fs");

26const os = require("os");

27const path = require("path");

28const http = require("http");

29const https = require("https");

30const { execFileSync, spawn, spawnSync } = require("child_process");

High

Child Process

Package source references child process execution.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L29

32const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L27

34// Daemon base URL resolution (issue #1571 — remote/network parity with

35// @remnic/plugin-pi's `remnicDaemonUrl`). A full REMNIC_DAEMON_URL

36// (e.g. "http://macstudio.tailnet:4318" or "https://remnic.internal:443")

37// takes precedence and lets a Codex host talk to a shared central daemon

38// over Tailscale/LAN/VPN. The legacy REMNIC_HOST/REMNIC_PORT pair remains

39// supported as a backward-compat fallback so existing installs and the

40// test harness (which spins a mock on 127.0.0.1:<port>) keep working.

41const RAW_DAEMON_URL = process.env.REMNIC_DAEMON_URL || process.env.ENGRAM_DAEMON_URL || "";

42const HOST = process.env.REMNIC_HOST || process.env.ENGRAM_HOST || "127.0.0.1";

43const PORT = process.env.REMNIC_PORT || process.env.ENGRAM_PORT || "4318";

45// Parse once. `protocol` is "http:" or "https:" so https.request is selected

46// for TLS daemons (common for remote/private deployments behind a proxy).

47//

48// An EXPLICIT but invalid REMNIC_DAEMON_URL (missing scheme, typo, e.g.

49// "macstudio:4318") must NOT silently fall through to REMNIC_HOST/REMNIC_PORT —

Lines 1118-1158javascript

1118 }

1119 } catch {

1120 /* ignore */

1121 }

1122 }

1123

1124 // Force HOME to the home dir the runner resolved (HOME → USERPROFILE →

1125 // os.homedir()). The materializer resolves config paths from HOME and only

1126 // falls back to os.homedir(); on Windows, where HOME is typically unset,

1127 // passing it explicitly guarantees the child uses the SAME home as the hook

1128 // instead of diverging (#1443 review).

hooks/bin/remnic-codex-hook.ps1View file

•path = hooks/bin/remnic-codex-hook.ps1 kind = build_helper sizeBytes = 525 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/bin/remnic-codex-hook.ps1View on unpkg

Source & flagged code

4 flagged · loading source

hooks/bin/remnic-codex-hook.cjsView file

29const https = require("https"); L30: const { execFileSync, spawn, spawnSync } = require("child_process"); L31:

High

Child Process

Package source references child process execution.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L29

27const path = require("path"); L28: const http = require("http"); L29: const https = require("https"); L30: const { execFileSync, spawn, spawnSync } = require("child_process"); L31: L32: const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir(); L33:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L27

1138} else if (repoRoot) { L1139: const r = spawnSync("npx", ["--yes", "tsx", "scripts/codex-materialize.ts", "--reason", "session_end"], { L1140: cwd: repoRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hooks/bin/remnic-codex-hook.cjsView on unpkg · L1138

hooks/bin/remnic-codex-hook.ps1View file

•path = hooks/bin/remnic-codex-hook.ps1 kind = build_helper sizeBytes = 525 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/bin/remnic-codex-hook.ps1View on unpkg

Findings

3 High4 Medium3 Low

HighChild Processhooks/bin/remnic-codex-hook.cjs

HighSame File Env Network Executionhooks/bin/remnic-codex-hook.cjs

HighRuntime Package Installhooks/bin/remnic-codex-hook.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperhooks/bin/remnic-codex-hook.ps1

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings