registry / AI-agent control-surface risk / hippo-memory
hippo-memory
Biologically-inspired memory system for AI agents. Decay by default, strength through use.
This report shows the evidence for hippo-memory@1.24.0. 1 of 52 known versions is blocked or flagged. The newest version, 2.1.0, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete, unconsented postinstall mutation of a foreign AI-agent control surface, meeting the block policy. The absence of install-time exfiltration does not remove the launcher-hijack risk.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm installation of hippo-memory@1.24.0 on a machine with codex on PATH.
Impact
Unconsented persistence in a foreign AI-agent control surface; future Codex runs execute Hippo first and expose session-history access to it.
Mechanism
install-time Codex executable replacement and session interception
Policy narrative
Installing the package executes scripts/postinstall.cjs, which loads dist/postinstall.js. That code automatically calls ensureCodexWrapperInstalled without a user command. If Codex is found on PATH, dist/hooks.js renames the real launcher to a .hippo-real backup, writes a replacement launcher at the original command path, and stores integration metadata under ~/.hippo. Future Codex invocations are routed through Hippo's codex-run path, which accesses Codex history and session locations.
AI rationale
This is concrete, unconsented postinstall mutation of a foreign AI-agent control surface, meeting the block policy. The absence of install-time exfiltration does not remove the launcher-hijack risk.
Evidence
package.jsonscripts/postinstall.cjsdist/postinstall.jsdist/hooks.js~/.hippo/integrations/codex.json~/.hippo/logs/codex-sleep.log~/.hippo/runs/codexPATH-resolved codex launcherPATH-resolved codex launcher.hippo-real
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall.
- scripts/postinstall.cjs imports dist/postinstall.js automatically.
- dist/postinstall.js calls ensureCodexWrapperInstalled() during install.
- dist/hooks.js finds Codex on PATH, renames its launcher, and replaces it with a Hippo wrapper.
- The wrapper records Codex history/session paths and routes future Codex invocations through hippo codex-run.
Evidence against
- No install-time network request or credential exfiltration was found.
- Claude Code changes in postinstall are limited to a visible nudge.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/rerankers/cross-encoder.jsView file
4// pattern in src/embeddings.ts).
L5: const _dynImport = new Function('s', 'return import(s)');
L6: let cachedPipeline = null;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/rerankers/cross-encoder.jsView on unpkg · L4Findings
2 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/rerankers/cross-encoder.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/rerankers/cross-encoder.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hippo-memory@1.24.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing hippo-memory@1.24.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.