Loading npm security reports…

@xmem.space/openclaw-plugin@8.1.2: AI-agent control-surface risk | LPM Firewall

registry / @xmem.space/openclaw-plugin / 8.1.2

@xmem.space/openclaw-plugin@8.1.2

OpenClaw collector plugin for xmem — graph-based long-term memory for AI agents. Deep workspace capture (all relevant file types, 4 levels deep, periodic re-scan every 2h). Multi-agent aware with per-agent Space/Key routing. Triple-ingest (artifacts + att

AI Security Review

scanned 22d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, a postinstall shell script edits the user's OpenClaw config and allowlists this plugin. After the agent loads it, bootstrap scanning can upload workspace files to the vendor API.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of this package, which runs the postinstall lifecycle script

Impact

the plugin is enabled on OpenClaw without a separate consent step, and workspace files can later be sent to api.xmem.space

Mechanism

silent rewrite of OpenClaw allowlists, then workspace ingest

Policy narrative

npm install runs a hidden postinstall script that edits ~/.openclaw/openclaw.json. It adds memtap to tools.allow and plugins.allow, turning this third-party plugin on without a separate setup command. Failures are swallowed. After OpenClaw loads the plugin, a bootstrap hook can scan the workspace and POST file contents to api.xmem.space. That is unconsented mutation of a foreign agent control surface.

AI rationale

The postinstall script rewrites OpenClaw's user config to allowlist this plugin, which is unconsented mutation of a foreign agent control surface. Workspace upload to api.xmem.space is the follow-on effect once the plugin is enabled and an API key is present.

Evidence

package.jsonscripts/post-install.shindex.ts~/.openclaw/openclaw.json

Network endpoints2

api.xmem.space

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/post-install.sh 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/post-install.sh 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/post-install.shView file

•path = scripts/post-install.sh kind = build_helper sizeBytes = 2141 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/post-install.shView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @xmem.space/openclaw-plugin@8.1.1 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:8.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1ac2230ec1b1d1d7 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @xmem.space/openclaw-plugin@8.1.1 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:8.1.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

index.tsView file

•matchType = normalized_sha256 matchedPackage = @xmem.space/openclaw-plugin@8.1.1 matchedPath = index.ts matchedIdentity = npm:[redacted]:8.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.tsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 21-55json

21 "url": "https://github.com/xmem-space/plugin-openclaw.git"

22 },

23 "bugs": {

24 "url": "https://github.com/xmem-space/plugin-openclaw/issues"

25 },

26 "openclaw": {

27 "extensions": [

28 "./dist/index.js"

29 ]

30 },

31 "dependencies": {

32 "ignore": "^5.3.2"

33 },

34 "devDependencies": {

35 "@types/node": "^22.0.0",

36 "typescript": "^5.6.0"

37 },

38 "scripts": {

39 "build": "tsc",

40 "prepublishOnly": "npm run build",

41 "postinstall": "bash scripts/post-install.sh 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "files": [

44 "dist/",

45 "index.ts",

46 "openclaw.plugin.json",

47 "README.md",

48 "scripts/post-install.sh",

49 "scripts/xmemignore.template"

50 ],

51 "engines": {

52 "node": ">=18"

53 }

54}

55

scripts/post-install.shView file

•path = scripts/post-install.sh kind = build_helper sizeBytes = 2141 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/post-install.shView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @xmem.space/openclaw-plugin@8.1.1 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:8.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1ac2230ec1b1d1d7 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @xmem.space/openclaw-plugin@8.1.1 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:8.1.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

index.tsView file

•matchType = normalized_sha256 matchedPackage = @xmem.space/openclaw-plugin@8.1.1 matchedPath = index.ts matchedIdentity = npm:[redacted]:8.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.tsView on unpkg