hippo-memory@1.65.0

Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The install lifecycle path inspected does not establish unconsented agent configuration changes, while the agent setup and scheduling behaviors are reached through explicit CLI commands. The inspected behavior is consistent with the package's memory integration and maintenance functions, so the scanner signals do not establish maliciousness.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs hippo init or hippo setup to configure integrations or scheduling.

Impact

These flows configure the package's memory integrations and routine maintenance; no confirmed malicious effect was established.

Mechanism

The CLI detects installed tools and project configuration, registers workspaces, and can create a scheduled runner; the install hook delegates to a postinstall entry whose inspected behavior is repair-only or informational.

AI rationale

Evidence

package.jsonscripts/postinstall.cjsdist/postinstall.jsdist/cli/init.jsdist/cli/setup.jsdist/scheduler.jsdist/cli/shared.js

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest's install hook runs a local postinstall script.
The inspected postinstall entry returns when disabled and describes its Codex action as repair-only for an existing wrapper.
The init path checks for existing agent configuration files before selecting integrations.
Init has a flag that skips its agent configuration writes.
The setup behavior is exposed through the explicit hippo setup command.
Workspace registration saves project paths to the registry.
The daily runner is created by the scheduling helper using the global store path.

Evidence against

The package has a postinstall hook and can create a scheduled daily runner, but the inspected runner setup is invoked from CLI setup flows.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/local-embedding.jsView file

31// Promise<object> names that honestly without claiming a specific module shape. L32: const _dynImport = new Function('s', 'return import(s)'); L33: /** Check (synchronously) if @xenova/transformers or @huggingface/transformers is installed. */

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/local-embedding.jsView on unpkg · L31

dist/rerankers/cross-encoder.jsView file

4const MODEL_NAME = 'Xenova/ms-marco-MiniLM-L-6-v2'; L5: const _require = createRequire(import.meta.url); L6: const TRANSFORMERS_PACKAGES = ['@huggingface/transformers', '@xenova/transformers'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rerankers/cross-encoder.jsView on unpkg · L4

dist/scheduler.jsView file

40Trigger-reachable persistence chain: manifest.bin -> bin/hippo.js -> dist/cli.js -> dist/cli/init.js -> dist/scheduler.js L40: try { L41: const parsed = JSON.parse(text); L42: const workspaces = Array.isArray(parsed.workspaces) ... L82: } L83: export function buildDailyRunnerCommand(projectDir, platform = process.platform) { L84: if (platform === 'win32') { ... L94: } L95: /** Argv for `schtasks`, passed without a shell: through cmd.exe the `&&` in /tr split the command. */ L96: export function buildSchtasksCreateArgs(taskName, cmd) {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/scheduler.jsView on unpkg · L40

40try { L41: const parsed = JSON.parse(text); L42: const workspaces = Array.isArray(parsed.workspaces) ... L82: } L83: export function buildDailyRunnerCommand(projectDir, platform = process.platform) { L84: if (platform === 'win32') { ... L94: } L95: /** Argv for `schtasks`, passed without a shell: through cmd.exe the `&&` in /tr split the command. */ L96: export function buildSchtasksCreateArgs(taskName, cmd) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/scheduler.jsView on unpkg · L40

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. printerror(`unknown hook target: ${target ?? '(none)'}`); process.exit(1); } unpatchagentfile(hooks[target], target); if (target === 'claude-code') { if (uninstalljsonhooks(target)) { console.log(`removed hippo hooks from ${target} settings`); } else { warnclaudesettingsunusable(checkuninstallable(target), '', 'uninstall'); } } else if (target === 'opencode') {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

dist/cli/shared.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/shared.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/local-embedding.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/local-embedding.jsView on unpkg · L31

Findings

4 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

HighTrigger Reachable Persistencedist/scheduler.js

HighSemantic Analysis Limiteddist/cli/shared.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/rerankers/cross-encoder.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/scheduler.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/local-embedding.js

Affected versions and remediation

This report applies to hippo-memory@1.65.0.

See all versions of hippo-memory for other recorded verdicts.

Review the evidence and your use of hippo-memory@1.65.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 20:29:32.791Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code