registry / hippo-memory / 1.43.3

hippo-memory@1.43.3

Biologically-inspired memory for AI agents. Zero runtime deps, SQLite, MCP server, and an opt-in hosted TypeSafe Jev reranker. Decay, retrieval strengthening, consolidation.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The source shows install-time repair of an existing, previously installed Codex wrapper and visible setup nudges; broader hook installation is initiated through CLI commands. The inspected findings support intended memory and agent integration features, with no confirmed attack behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Running the package’s postinstall hook or explicitly invoking its setup CLI commands.

Impact

The inspected install behavior does not establish unconsented first-time agent configuration changes or credential exposure.

Mechanism

Postinstall checks for an existing Codex wrapper to repair and prints setup nudges; CLI setup installs hooks for detected agent tools.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest identifies the package and its entry points; its postinstall hook runs a local script.
The install-time script repairs a Codex wrapper only if one was already installed and prints setup nudges.
Agent hook setup is exposed through CLI commands; `hippo init` performs project hook installation.
Capture code reads Claude project session files for memory capture.
Embedding provider selection defaults to local unless configuration or options select another provider.
Prediction helpers describe tenant-scoped records, with matching copies in both prediction files.

Evidence against

The scanner’s similarity and agent-configuration findings do not establish malicious behavior: the inspected install path does not perform first-time agent setup, and hook installation is available through the CLI.
No inspected source established credential theft, an unrelated network recipient, or a malicious payload chain.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVars

Source & flagged code

9 flagged

package.jsonView file

Lines 15-55json

15 "bin": {

16 "hippo": "bin/hippo.js"

17 },

18 "files": [

19 "dist",

20 "dist-ui",

21 "bin",

22 "scripts/postinstall.cjs",

23 "openclaw.plugin.json",

24 "extensions/openclaw-plugin"

25 ],

26 "scripts": {

27 "baseline": "npm run build && npm test",

28 "build": "tsc && tsc -p tsconfig.benchmarks.json && tsc -p tsconfig.extensions.json",

29 "dev": "tsc --watch",

30 "pretest": "npm run build",

31 "test": "vitest run",

32 "test:watch": "vitest",

33 "lint": "oxlint",

34 "audit:security": "npm audit --audit-level=high && npm --prefix ui audit --audit-level=high",

35 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 "smoke:pack": "node scripts/smoke-pack.mjs",

37 "smoke:openclaw-install": "node scripts/smoke-openclaw-install.mjs",

38 "build:ui": "cd ui && npm install && npm run build",

39 "build:all": "npm run build && npm run build:ui",

40 "prepublishOnly": "node scripts/check-manifest-versions.mjs && node scripts/check-em-dashes-in-release-notes.mjs && node scripts/check-graph-writes.mjs && npm run build:all && node scripts/check-openclaw-dist.mjs && npm run smoke:openclaw-install && node scripts/check-tests-pass.mjs"

41 },

42 "keywords": [

43 "memory",

44 "ai",

45 "agents",

46 "llm",

47 "claude",

48 "context",

49 "recall",

50 "episodic",

51 "semantic",

52 "embeddings",

53 "hybrid-search",

54 "agent-memory",

55 "long-term-memory",

dist/embeddings.jsView file

Lines 78-118javascript

78 * official inference code in `FlagEmbedding`); MiniLM and most sentence-

79 * transformers models use mean pooling. Unknown model ids default to mean

80 * — that is the safe choice because most third-party models adopt the

81 * sentence-transformers convention, and the

dist/rerankers/cross-encoder.jsView file

Lines 1-23javascript

1import { createRequire } from 'node:module';

2import { pathToFileURL } from 'node:url';

3const MODEL_NAME = 'Xenova/ms-marco-MiniLM-L-6-v2';

4const _require

dist/hooks.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. } } } return out; } function [redacted](historypath, startoffsetbytes) { if (!fs.existssync(historypath)) return []; const raw = fs.readfilesync(historypath); if (startoffsetbytes >= raw.length) return []; const delta = raw.subarray(startoffsetbytes).tostring('utf8'); const seen = new set(); const ordered = []; for (const line of delta.split('\n')) { if (!line.trim()) continue; try { const parsed = json.parse(line); const sessionid = parsed.session_id; if (isjsonstring(sessionid) && sessionid && !seen.has(sessionid)) { seen.add(sessionid);

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks.jsView on unpkg

dist/embedding-provider.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/embedding-provider.js#virtual:normalized:round1View on unpkg

dist/predictions.jsView file

•matchType = normalized_sha256 matchedPackage = hippo-memory@1.24.0 matchedPath = dist/predictions.js matchedIdentity = npm:aGlwcG8tbWVtb3J5:1.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/predictions.jsView on unpkg

dist/src/predictions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/predictions.jsView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = hippo-memory@1.40.0 matchedIdentity = npm:aGlwcG8tbWVtb3J5:1.40.0 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/embeddings.jsView file

98// Promise<object> names that honestly without claiming a specific module shape. L99: const _dynImport = new Function('s', 'return import(s)'); L100: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/embeddings.jsView on unpkg · L98

Findings

6 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/hooks.js

HighSemantic Analysis Limiteddist/embedding-provider.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/predictions.js

HighKnown Malware Source Similaritydist/src/predictions.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/rerankers/cross-encoder.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to hippo-memory@1.43.3.

See all versions of hippo-memory for other recorded verdicts.

Review the evidence and your use of hippo-memory@1.43.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 05:42:49.363Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.