registry / codex-supermemory / 1.0.14
codex-supermemory@1.0.14
⚠ Under reviewPersistent memory for OpenAI Codex CLI — powered by Supermemory
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/hooks/recall.jsView file
14// src/services/auth.ts
L15: var import_node_http = require("node:http");
L16: var import_node_fs = require("node:fs");
...
L24: // src/services/openUrl.ts
L25: var import_node_child_process = require("node:child_process");
L26: function run(command, args) {
...
L38: }
L39: if (process.platform === "win32") {
L40: try {
...
L44: }
L45: await run("cmd.exe", ["/c", "start", '""', href]);
L46: return;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/hooks/recall.jsView on unpkg · L1424// src/services/openUrl.ts
L25: var import_node_child_process = require("node:child_process");
L26: function run(command, args) {
High
Child Process
Package source references child process execution.
dist/hooks/recall.jsView on unpkg · L2444}
L45: await run("cmd.exe", ["/c", "start", '""', href]);
L46: return;
...
L57: var CREDENTIALS_FILE = (0, import_node_path.join)(SUPERMEMORY_DIR, "credentials.json");
L58: var AUTH_BASE_URL = process.env.SUPERMEMORY_AUTH_URL || "https://app.supermemory.ai/auth/agent-connect";
L59: var AUTH_TIMEOUT = Number(process.env.SUPERMEMORY_AUTH_TIMEOUT) || 5 * 6e4;
Findings
1 Critical4 High4 Medium4 Low
CriticalCredential Exfiltrationdist/hooks/recall.js
HighChild Processdist/hooks/recall.js
HighEvaldist/cli.js
HighSame File Env Network Executiondist/hooks/recall.js
HighSandbox Evasion Gated Capabilitydist/hooks/recall.js
MediumDynamic Requiredist/hooks/recall.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codex-supermemory@1.0.14.
See all versions of codex-supermemory for other recorded verdicts.
- Review the evidence and your use of codex-supermemory@1.0.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.