codex-supermemory@1.0.18
Persistent memory for OpenAI Codex CLI — powered by Supermemory
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe hook’s normal memory API credential flow targets Supermemory, but its automatic first-session authentication also sends the hostname and full working directory to the vendor’s auth endpoint. That undisclosed identifying data makes this suspicious telemetry rather than a credential theft finding.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A Codex session starts while no Supermemory API key is configured.
Impact
The auth service receives the machine hostname and local project path, which may reveal a username or project name.
Mechanism
The hook creates an authentication URL containing the machine hostname and current working directory, then opens it in a browser.
AI rationale
The hook’s normal memory API credential flow targets Supermemory, but its automatic first-session authentication also sends the hostname and full working directory to the vendor’s auth endpoint. That undisclosed identifying data makes this suspicious telemetry rather than a credential theft finding.
Evidence
dist/hooks/session-start.js~/.codex/supermemory/credentials.json
Network endpoints1
console.supermemory.ai/auth/connect
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The session-start hook automatically starts authentication when no API key is configured.
- The auth query parameters include the machine hostname and full current working directory.
- The hook opens the auth URL at console.supermemory.ai, sending those parameters to the service.
Evidence against
- package.json declares build, typecheck, and test scripts, but no install lifecycle script.
- Memory API requests use the configured Supermemory API base URL, with the service default when none is set.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/hooks/recall.jsView file
177var import_node_crypto = require("node:crypto");
L178: var import_node_child_process = require("node:child_process");
L179: var import_node_fs3 = require("node:fs");
High
Child Process
Package source references child process execution.
dist/hooks/recall.jsView on unpkg · L177dist/cli.jsView file
413try {
L414: const utilInspect = eval("require('util').inspect");
L415: _custom = utilInspect.custom;
High
dist/hooks/mcp-proxy.jsView file
4// src/hooks/mcp-proxy.ts
L5: var import_node_readline = require("node:readline");
L6:
Findings
1 Critical4 High4 Medium4 Low
CriticalCredential Exfiltrationdist/hooks/session-start.js
HighChild Processdist/hooks/recall.js
HighEvaldist/cli.js
HighSame File Env Network Executiondist/hooks/session-start.js
HighSandbox Evasion Gated Capabilitydist/hooks/session-start.js
MediumDynamic Requiredist/hooks/mcp-proxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codex-supermemory@1.0.18.
See all versions of codex-supermemory for other recorded verdicts.
- Review the evidence and your use of codex-supermemory@1.0.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.