registry / codex-supermemory / 1.0.16
codex-supermemory@1.0.16
Persistent memory for OpenAI Codex CLI — powered by Supermemory
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential flow supplies a Supermemory-specific key to the configured Supermemory client, and the default API host belongs to that service. The session hook's automatic profile lookup and authentication flow match the package's stated purpose.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
After the package is explicitly installed, its registered session-start hook runs when a Codex session starts.
Impact
No malicious impact was identified in the reviewed paths.
Mechanism
The hook uses Supermemory credentials and project tags to retrieve saved memory from the configured Supermemory API. Missing credentials trigger the authentication flow.
AI rationale
The flagged credential flow supplies a Supermemory-specific key to the configured Supermemory client, and the default API host belongs to that service. The session hook's automatic profile lookup and authentication flow match the package's stated purpose.
Network endpoints3
api.supermemory.aiconsole.supermemory.airegistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes the package as persistent memory for Codex powered by Supermemory.
- The API key is read from Supermemory-specific environment or configuration credentials and supplied to the Supermemory client.
- The default API host is api.supermemory.ai; the base URL can be configured for the service.
- The session-start hook uses the Codex session input and project tags to fetch saved profile context.
- When no key is configured, the hook starts the Supermemory authentication flow.
Evidence against
- The session hook makes automatic requests and derives lookup tags from project and user information, consistent with its advertised memory feature.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/hooks/recall.jsView file
177var import_node_crypto = require("node:crypto");
L178: var import_node_child_process = require("node:child_process");
L179: var import_node_fs3 = require("node:fs");
High
Child Process
Package source references child process execution.
dist/hooks/recall.jsView on unpkg · L177dist/cli.jsView file
413try {
L414: const utilInspect = eval("require('util').inspect");
L415: _custom = utilInspect.custom;
High
dist/hooks/mcp-proxy.jsView file
4// src/hooks/mcp-proxy.ts
L5: var import_node_readline = require("node:readline");
L6:
Findings
1 Critical4 High4 Medium4 Low
CriticalCredential Exfiltrationdist/hooks/session-start.js
HighChild Processdist/hooks/recall.js
HighEvaldist/cli.js
HighSame File Env Network Executiondist/hooks/session-start.js
HighSandbox Evasion Gated Capabilitydist/hooks/session-start.js
MediumDynamic Requiredist/hooks/mcp-proxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codex-supermemory@1.0.16.
See all versions of codex-supermemory for other recorded verdicts.
- Review the evidence and your use of codex-supermemory@1.0.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.