Loading npm security reports…

@vib795/agent-memory@0.1.3: AI-agent control-surface risk | LPM Firewall

registry / @vib795/agent-memory / 0.1.3

@vib795/agent-memory@0.1.3

Durable cross-repo knowledge graph for GitHub Copilot and Claude Code. Markdown source of truth, disposable SQLite index, zero runtime dependencies.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates a user-wide AI-agent control surface. It installs packaged skills into ~/.agents/skills unconditionally and into detected Claude/Codex/editor locations.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of @vib795/agent-memory@0.1.3

Impact

Foreign coding agents may automatically discover and follow package-supplied instructions, including filesystem-writing workflows.

Mechanism

postinstall deployment of agent skills and prompt files

Policy narrative

Installation automatically executes setup, which unconditionally creates ~/.agents/skills and installs three package-controlled skills there. Detected Claude Code, Codex, and VS Code locations receive the same skills or generated agent-mode prompts. This mutates user-wide, foreign AI-agent instruction surfaces without an explicit setup command.

Rationale

The package has no confirmed exfiltration or remote execution, but its postinstall hook concretely and unconsentedly installs active instructions into broad third-party AI-agent control surfaces. That meets the firewall block boundary.

Evidence

package.jsonscripts/postinstall.jssrc/targets.jssrc/setup.jssrc/promptfile.jsskills/handoff/SKILL.md~/.agents/skills/handoff~/.agents/skills/recall~/.agents/skills/remember~/.claude/skills/*

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/targets.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L58: const overridden = Boolean(process.env.AGENT_MEMORY_SKILLS_HOME); L59: return (!overridden && process.env.CODEX_HOME) || join(home, '.codex'); L60: } ... L83: kind: 'skill-dir', L84: dir: join(home, '.agents', 'skills'), L85: // Always installed: this is the location this project defines, so its absence ... L93: kind: 'skill-dir', L94: dir: join(home, '.claude', 'skills'), L95: detected: existsSync(join(home, '.claude')), L96: }, Write operation from src/atomic.js: L1: import { writeFileSync, renameSync, rmSync } from 'node:fs'; L2: ... L40: const tmp = tempName(target); L41: writeFileSync(tmp, contents, 'utf8'); L42: for (let attempt = 0; ; attempt++) { Foreign user/project scope from src/config.js: L9: process.e

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/targets.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1308 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/cli.jsView file

•matchType = malicious_source_fingerprint_signature signature = e4409187e094e3b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @vib795/agent-memory@0.1.0 matchedPath = src/cli.js matchedIdentity = npm:QHZpYjc5NS9hZ2VudC1tZW1vcnk:0.1.0 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/cli.jsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 10-48json

10 "knowledge-graph",

11 "sqlite",

12 "zero-dependencies"

13 ],

14 "homepage": "https://github.com/vib795/agent-memory#readme",

15 "bugs": "https://github.com/vib795/agent-memory/issues",

16 "repository": {

17 "type": "git",

18 "url": "git+https://github.com/vib795/agent-memory.git"

19 },

20 "author": "Utkarsh Singh (https://github.com/vib795)",

21 "type": "module",

22 "bin": {

23 "agent-memory": "src/cli.js"

24 },

25 "engines": {

26 "node": ">=22.5.0"

27 },

28 "scripts": {

29 "test": "node --test",

30 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "setup": "node src/cli.js setup"

32 },

33 "files": [

34 "src/",

35 "scripts/",

36 "skills/",

37 "install.sh",

38 "install.ps1",

39 "README.md",

40 "HOWTO.md",

41 "LICENSE"

42 ],

43 "license": "MIT",

44 "publishConfig": {

45 "access": "public"

46 }

47}

48

src/targets.jsView file

Lines 1-21javascript

1import { existsSync } from 'node:fs';

2import { join } from 'node:path';

3import { homedir, platform } from 'node:os';

4

5/**

6 * Where the agents on this machine look for their instructions.

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1308 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/cli.jsView file

•matchType = malicious_source_fingerprint_signature signature = e4409187e094e3b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @vib795/agent-memory@0.1.0 matchedPath = src/cli.js matchedIdentity = npm:QHZpYjc5NS9hZ2VudC1tZW1vcnk:0.1.0 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/cli.jsView on unpkg