hippo-memory@1.68.0
Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe flagged agent configuration and persistence behaviors are user-command driven and aligned with the package’s integration features, rather than hidden in npm installation. Because `hippo init` can modify agent configuration and schedule recurring work, classify it as a warning-level agent capability.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `hippo init` in a project; `--no-hooks` and `--no-schedule` disable those respective integrations.
Impact
Agent behavior can be extended by Hippo hooks, and registered workspaces receive recurring maintenance. No npm-install-time agent configuration mutation or concrete malicious behavior was identified.
Mechanism
Init detects installed agents, patches existing instruction files, installs hooks, and adds a scheduled daily runner.
AI rationale
The flagged agent configuration and persistence behaviors are user-command driven and aligned with the package’s integration features, rather than hidden in npm installation. Because `hippo init` can modify agent configuration and schedule recurring work, classify it as a warning-level agent capability.
Evidence
dist/cli/init.jsdist/cli/shared.jspackage.jsondist/postinstall.js
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `hippo init` automatically installs detected agent integrations and a daily schedule unless the user disables them.
- The integrations patch existing agent instruction files and add user-level hooks for detected agents.
- The postinstall hook repairs an existing Codex wrapper and prints setup suggestions; it does not install agent hooks.
- The daily schedule runs Hippo maintenance against registered workspaces.
Evidence against
- The agent configuration and scheduling changes are reached through the explicit `hippo init` command, not the npm install hook.
- The package offers `--no-hooks`, `--no-schedule`, and `HIPPO_SKIP_AUTO_INTEGRATIONS` controls.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/local-embedding.jsView file
31// Promise<object> names that honestly without claiming a specific module shape.
L32: const _dynImport = new Function('s', 'return import(s)');
L33: /** Check (synchronously) if @xenova/transformers or @huggingface/transformers is installed. */
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/local-embedding.jsView on unpkg · L31Findings
5 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
HighTrigger Reachable Persistencedist/scheduler.js
HighSemantic Analysis Limiteddist/cli/shared.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/cli/shared.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/rerankers/cross-encoder.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/scheduler.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to hippo-memory@1.68.0.
See all versions of hippo-memory for other recorded verdicts.
- Review the evidence and your use of hippo-memory@1.68.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.