Loading npm security reports…

@vib795/agent-memory@0.1.4: AI-agent control-surface risk | LPM Firewall

registry / @vib795/agent-memory / 0.1.4

@vib795/agent-memory@0.1.4

Durable cross-repo knowledge graph for GitHub Copilot and Claude Code. Markdown source of truth, disposable SQLite index, zero runtime dependencies.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall automatically installs package-controlled skills into multiple external AI-agent directories. It writes agent-mode prompt files and symlinks/copies packaged instructions without an explicit setup action.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install, including dependency installation with lifecycle scripts enabled

Impact

Future Codex, Claude, Copilot, and VS Code agent sessions can load package-supplied instructions and execute their prescribed tool actions.

Mechanism

postinstall mutation of broad AI-agent control surfaces

Policy narrative

Installing the package invokes postinstall, which calls setup() and writes or links three package-controlled skills into detected agent directories. These include the shared ~/.agents path unconditionally and Codex, Claude, and VS Code prompt locations when present; generated VS Code prompts use agent mode. This is unconsented install-time mutation of foreign, broad AI-agent control surfaces.

Rationale

The package contains no confirmed exfiltration chain, but its automatic lifecycle hook installs executable agent instructions across unrelated AI-agent platforms. That meets the firewall block boundary for unconsented postinstall mutation of a foreign/broad AI-agent control surface.

Evidence

package.jsonscripts/postinstall.jssrc/setup.jssrc/targets.jssrc/promptfile.jsskills/handoff/SKILL.mdskills/recall/SKILL.mdskills/remember/SKILL.md

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/targets.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L58: const overridden = Boolean(process.env.AGENT_MEMORY_SKILLS_HOME); L59: return (!overridden && process.env.CODEX_HOME) || join(home, '.codex'); L60: } ... L83: kind: 'skill-dir', L84: dir: join(home, '.agents', 'skills'), L85: // Always installed: this is the location this project defines, so its absence ... L93: kind: 'skill-dir', L94: dir: join(home, '.claude', 'skills'), L95: detected: existsSync(join(home, '.claude')), L96: }, Write operation from src/atomic.js: L1: import { writeFileSync, renameSync, rmSync } from 'node:fs'; L2: ... L40: const tmp = tempName(target); L41: writeFileSync(tmp, contents, 'utf8'); L42: for (let attempt = 0; ; attempt++) { Foreign user/project scope from src/config.js: L9: process.e

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/targets.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1308 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/cli.jsView file

•matchType = malicious_source_fingerprint_signature signature = e4409187e094e3b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @vib795/agent-memory@0.1.3 matchedPath = src/cli.js matchedIdentity = npm:QHZpYjc5NS9hZ2VudC1tZW1vcnk:0.1.3 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/cli.jsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 10-48json

10 "knowledge-graph",

11 "sqlite",

12 "zero-dependencies"

13 ],

14 "homepage": "https://github.com/vib795/agent-memory#readme",

15 "bugs": "https://github.com/vib795/agent-memory/issues",

16 "repository": {

17 "type": "git",

18 "url": "git+https://github.com/vib795/agent-memory.git"

19 },

20 "author": "Utkarsh Singh (https://github.com/vib795)",

21 "type": "module",

22 "bin": {

23 "agent-memory": "src/cli.js"

24 },

25 "engines": {

26 "node": ">=22.5.0"

27 },

28 "scripts": {

29 "test": "node --test",

30 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "setup": "node src/cli.js setup"

32 },

33 "files": [

34 "src/",

35 "scripts/",

36 "skills/",

37 "install.sh",

38 "install.ps1",

39 "README.md",

40 "HOWTO.md",

41 "LICENSE"

42 ],

43 "license": "MIT",

44 "publishConfig": {

45 "access": "public"

46 }

47}

48

src/targets.jsView file

Lines 1-21javascript

1import { existsSync } from 'node:fs';

2import { join } from 'node:path';

3import { homedir, platform } from 'node:os';

4

5/**

6 * Where the agents on this machine look for their instructions.

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1308 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/cli.jsView file

•matchType = malicious_source_fingerprint_signature signature = e4409187e094e3b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @vib795/agent-memory@0.1.3 matchedPath = src/cli.js matchedIdentity = npm:QHZpYjc5NS9hZ2VudC1tZW1vcnk:0.1.3 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/cli.jsView on unpkg