Loading npm security reports…

@tencentdb-agent-memory/memory-tencentdb@1.0.2: Malicious npm | LPM Firewall

registry / @tencentdb-agent-memory/memory-tencentdb / 1.0.2

@tencentdb-agent-memory/memory-tencentdb@1.0.2

Four-layer local memory system plugin for OpenClaw — auto-captures, structures, and profiles conversational knowledge using local LLM + SQLite vector search (L0→L1→L2→L3 pipeline)

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package automatically modifies an unrelated OpenClaw installation. The patch exposes complete session messages to tool-call hooks and the runtime code enables conversation access.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install runs postinstall; loading the plugin on a supported OpenClaw gateway can also alter its configuration.

Impact

An installed agent's conversation history is made available to hooks without an explicit setup action, weakening the host's access control.

Mechanism

Automatic foreign AI-agent hook and configuration mutation.

Attack narrative

On npm installation, postinstall invokes a shell script while discarding failures. The script discovers an OpenClaw installation, searches all matching distribution JavaScript files, backs them up, and edits hook events to include ctx.params.session messages. Separately, plugin startup can write allowConversationAccess into the user's OpenClaw configuration. This is unconsented mutation of a foreign AI-agent control surface that expands access to conversation data.

AI rationale

The package has a concrete automatic install-time chain that patches another product's runtime files to expose session messages. Its runtime configuration mutation further enables that expanded access.

Evidence

package.jsonscripts/openclaw-after-tool-call-messages.patch.shsrc/utils/ensure-hook-policy.ts$OPENCLAW_DIR/dist/*.js$OPENCLAW_DIR/dist/*.js.pre-offload-patch.bak$HOME/.openclaw/openclaw.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/openclaw-after-tool-call-messages.patch.sh 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/openclaw-after-tool-call-messages.patch.sh 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/export-tencent-vdb.mjsView file

19L20: import(entryScript);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/export-tencent-vdb.mjsView on unpkg · L19

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tencentdb-agent-memory/memory-tencentdb@1.0.1 matchedIdentity = npm:[redacted]:1.0.1 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

13import { fileURLToPath } from "url"; L14: import * as https from "node:https"; L15: import * as http from "node:http"; ... L132: cleaned = cleaned.replace(/^System:\s*\[[\s\S]*?$/gm, ""); L133: cleaned = cleaned.replace(/data:image\/[a-z+]+;base64,[A-Za-z0-9+/=]+/gi, ""); L134: cleaned = cleaned.replace(/\0/g, "").replace(/\n{3,}/g, "\n\n").trim(); ... L2343: /** Default root data directory (parent of all agent subdirectories) */ L2344: const DEFAULT_DATA_ROOT = join(homedir(), ".openclaw", "context-offload"); L2345: /** ... L5580: · 如果输入中该 tool pair 标记了 [NEEDS_COMPRESS]，你必须将工具名+关键参数压缩为一句简洁的描述（≤150字符），保留工具名、操作目标（如文件路径、命令意图），省略内联脚本/大段内容的细节。 L5581: 示例：exec({"command":"python3 -c 'import csv; ...200行脚本...'"}) → "exec: 运行 Python （xx/xx/xx.sh，标明具体路径和文件）脚本分析 sales_channels.csv 数据质量" L5582:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L13

hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.pyView file

•path = hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.py kind = build_helper sizeBytes = 0

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.pyView on unpkg

hermes-plugin/memory/memory_tencentdb_v2/tests/test_provider.pyView file

•path = hermes-plugin/memory/memory_tencentdb_v2/tests/test_provider.py kind = payload_in_excluded_dir sizeBytes = 5721 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

hermes-plugin/memory/memory_tencentdb_v2/tests/test_provider.pyView on unpkg

index.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.ts#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 15-55json

15 "default": "./dist/index.mjs"

16 }

17 },

18 "scripts": {

19 "build": "npm run build:plugin && npm run build:scripts",

20 "build:plugin": "tsdown",

21 "build:scripts": "npm run build:migrate-sqlite-to-vdb && npm run build:export-tencent-vdb && npm run build:read-local-memory && npm run build:seed-v2",

22 "prepack": "npm run build",

23 "build:migrate-sqlite-to-vdb": "tsc -p scripts/migrate-sqlite-to-tcvdb/tsconfig.json --noEmitOnError false",

24 "migrate-sqlite-to-tcvdb": "node ./bin/migrate-sqlite-to-tcvdb.mjs",

25 "build:export-tencent-vdb": "tsc --project scripts/export-tencent-vdb/tsconfig.json",

26 "export-tencent-vdb": "node ./bin/export-tencent-vdb.mjs",

27 "build:read-local-memory": "tsc --project scripts/read-local-memory/tsconfig.json",

28 "read-local-memory": "node ./bin/read-local-memory.mjs",

29 "build:seed-v2": "tsc --project scripts/seed-v2/tsconfig.json",

30 "seed-v2": "node ./bin/seed-v2.mjs",

31 "test": "vitest run",

32 "test:oss": "vitest run -c vitest.oss.config.ts",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "postinstall": "bash scripts/openclaw-after-tool-call-messages.patch.sh 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 },

37 "files": [

38 "dist/",

39 "bin/migrate-sqlite-to-tcvdb.mjs",

40 "bin/export-tencent-vdb.mjs",

41 "bin/read-local-memory.mjs",

42 "index.ts",

43 "scripts/migrate-sqlite-to-tcvdb/dist/",

44 "scripts/export-tencent-vdb/dist/",

45 "scripts/read-local-memory/dist/",

46 "scripts/memory-tencentdb-ctl.sh",

47 "scripts/install_hermes_memory_tencentdb.sh",

48 "scripts/install-hermes-plugin-v2.sh",

49 "scripts/install-openclaw-plugin-v2.sh",

50 "scripts/README.memory-tencentdb-ctl.md",

51 "src",

52 "scripts/openclaw-after-tool-call-messages.patch.sh",

53 "scripts/setup-offload.sh",

54 "hermes-plugin/",

55 "openclaw-plugin/",

bin/export-tencent-vdb.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2

3// 薄启动器：加载预编译好的 VDB 导出脚本。

4// 构建：npm run build:export-vdb

5// 使用：npm run export:vdb -- [参数] 或 node ./bin/export-tencent-vdb.mjs [参数]

6

7import path from "node:path";

8import { fileURLToPath } from "node:url";

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tencentdb-agent-memory/memory-tencentdb@1.0.1 matchedIdentity = npm:[redacted]:1.0.1 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

13import { fileURLToPath } from "url"; L14: import * as https from "node:https"; L15: import * as http from "node:http"; ... L132: cleaned = cleaned.replace(/^System:\s*\[[\s\S]*?$/gm, ""); L133: cleaned = cleaned.replace(/data:image\/[a-z+]+;base64,[A-Za-z0-9+/=]+/gi, ""); L134: cleaned = cleaned.replace(/\0/g, "").replace(/\n{3,}/g, "\n\n").trim(); ... L2343: /** Default root data directory (parent of all agent subdirectories) */ L2344: const DEFAULT_DATA_ROOT = join(homedir(), ".openclaw", "context-offload"); L2345: /** ... L5580: · 如果输入中该 tool pair 标记了 [NEEDS_COMPRESS]，你必须将工具名+关键参数压缩为一句简洁的描述（≤150字符），保留工具名、操作目标（如文件路径、命令意图），省略内联脚本/大段内容的细节。 L5581: 示例：exec({"command":"python3 -c 'import csv; ...200行脚本...'"}) → "exec: 运行 Python （xx/xx/xx.sh，标明具体路径和文件）脚本分析 sales_channels.csv 数据质量" L5582:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L13

hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.pyView file

•path = hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.py kind = build_helper sizeBytes = 0

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.pyView on unpkg

hermes-plugin/memory/memory_tencentdb_v2/tests/test_provider.pyView file

•path = hermes-plugin/memory/memory_tencentdb_v2/tests/test_provider.py kind = payload_in_excluded_dir sizeBytes = 5721 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

hermes-plugin/memory/memory_tencentdb_v2/tests/test_provider.pyView on unpkg

index.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.ts#virtual:normalized:round1View on unpkg