Loading npm security reports…

@vib795/agent-memory@0.1.1: AI-agent control-surface risk | LPM Firewall

registry / @vib795/agent-memory / 0.1.1

@vib795/agent-memory@0.1.1

Durable cross-repo knowledge graph for GitHub Copilot and Claude Code. Markdown source of truth, disposable SQLite index, zero runtime dependencies.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically mutates broad third-party AI-agent instruction surfaces. It links packaged skills and writes VS Code prompt files without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Package-controlled instructions become available to detected agent tools across the user profile.

Mechanism

postinstall creation of AI-agent skill links and prompt files

Policy narrative

On npm installation, postinstall imports setup, which writes package-controlled skill content into ~/.agents unconditionally and into detected Claude Code, Codex, and VS Code-family instruction locations. This changes foreign AI-agent control surfaces before the user explicitly runs the package CLI.

Rationale

The shipped content shows no exfiltration or remote payload behavior, but the automatic lifecycle hook performs concrete, unconsented writes to broad third-party AI-agent instruction surfaces. That meets the install-time control-surface mutation block boundary.

Evidence

package.jsonscripts/postinstall.jssrc/setup.jssrc/targets.jsskills/recall/SKILL.mdskills/remember/SKILL.mdskills/handoff/SKILL.md~/.agents/skills/{handoff,recall,remember}~/.claude/skills/{handoff,recall,remember}~/.codex/skills/{handoff,recall,remember}

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/targets.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L58: const overridden = Boolean(process.env.AGENT_MEMORY_SKILLS_HOME); L59: return (!overridden && process.env.CODEX_HOME) || join(home, '.codex'); L60: } ... L83: kind: 'skill-dir', L84: dir: join(home, '.agents', 'skills'), L85: // Always installed: this is the location this project defines, so its absence ... L93: kind: 'skill-dir', L94: dir: join(home, '.claude', 'skills'), L95: detected: existsSync(join(home, '.claude')), L96: }, Write operation from src/atomic.js: L1: import { writeFileSync, renameSync, rmSync } from 'node:fs'; L2: ... L40: const tmp = tempName(target); L41: writeFileSync(tmp, contents, 'utf8'); L42: for (let attempt = 0; ; attempt++) { Foreign user/project scope from src/config.js: L9: process.e

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/targets.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1308 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/cli.jsView file

•matchType = malicious_source_fingerprint_signature signature = e4409187e094e3b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @vib795/agent-memory@0.1.0 matchedPath = src/cli.js matchedIdentity = npm:QHZpYjc5NS9hZ2VudC1tZW1vcnk:0.1.0 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/cli.jsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 10-48json

10 "knowledge-graph",

11 "sqlite",

12 "zero-dependencies"

13 ],

14 "homepage": "https://github.com/vib795/agent-memory#readme",

15 "bugs": "https://github.com/vib795/agent-memory/issues",

16 "repository": {

17 "type": "git",

18 "url": "git+https://github.com/vib795/agent-memory.git"

19 },

20 "author": "Utkarsh Singh (https://github.com/vib795)",

21 "type": "module",

22 "bin": {

23 "agent-memory": "src/cli.js"

24 },

25 "engines": {

26 "node": ">=22.5.0"

27 },

28 "scripts": {

29 "test": "node --test",

30 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "setup": "node src/cli.js setup"

32 },

33 "files": [

34 "src/",

35 "scripts/",

36 "skills/",

37 "install.sh",

38 "install.ps1",

39 "README.md",

40 "HOWTO.md",

41 "LICENSE"

42 ],

43 "license": "MIT",

44 "publishConfig": {

45 "access": "public"

46 }

47}

48

src/targets.jsView file

Lines 1-21javascript

1import { existsSync } from 'node:fs';

2import { join } from 'node:path';

3import { homedir, platform } from 'node:os';

4

5/**

6 * Where the agents on this machine look for their instructions.

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1308 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/cli.jsView file

•matchType = malicious_source_fingerprint_signature signature = e4409187e094e3b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @vib795/agent-memory@0.1.0 matchedPath = src/cli.js matchedIdentity = npm:QHZpYjc5NS9hZ2VudC1tZW1vcnk:0.1.0 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/cli.jsView on unpkg