registry / hippo-memory / 1.71.0
hippo-memory@1.71.0
Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found a postinstall hook, but its package-local behavior is limited to guarded wrapper repair and setup nudges. Agent integration and scheduled workspace setup occur through `hippo init`; no concrete attack surface was established.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation runs the postinstall hook; users can separately run `hippo init` to configure integrations and workspace maintenance.
Impact
No confirmed unauthorized agent configuration change, credential exposure, or malicious persistence was established. The dashboard's inspected entrypoint is described as loopback-only with a per-start token.
Mechanism
The postinstall code checks a skip flag, tries wrapper repair, and prints nudges. Initialization detects existing agent markers and registers project paths in Hippo's workspace registry.
AI rationale
Source inspection found a postinstall hook, but its package-local behavior is limited to guarded wrapper repair and setup nudges. Agent integration and scheduled workspace setup occur through `hippo init`; no concrete attack surface was established.
Evidence
package.jsonscripts/postinstall.cjsdist/postinstall.jsdist/cli/init.jsdist/cli/scheduler.jsdist/dashboard/dashboard.js
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook imports a package-local module and exits when the skip flag is set.
- The postinstall module attempts repair of an existing Codex wrapper and prints setup nudges; it describes first-install integration as opt-in.
- Agent hook detection is part of the explicit `hippo init` flow and checks for existing agent markers.
- Workspace registration writes a normalized project path to the Hippo registry during initialization.
- The dashboard is served on loopback with a per-start token.
Evidence against
- The package defines a postinstall lifecycle hook.
- Initialization can register workspaces for daily maintenance, creating local persistence when the user runs setup.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/rerankers/cross-encoder.jsView file
7const MODEL_NAME = 'Xenova/ms-marco-MiniLM-L-6-v2';
L8: const _require = createRequire(import.meta.url);
L9: const TRANSFORMERS_PACKAGES = ['@huggingface/transformers', '@xenova/transformers'];
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/rerankers/cross-encoder.jsView on unpkg · L7Findings
3 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencedist/cli/scheduler.js
HighSemantic Analysis Limiteddist/dashboard/dashboard.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/rerankers/cross-encoder.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/scheduler.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hippo-memory@1.71.0.
See all versions of hippo-memory for other recorded verdicts.
- Review the evidence and your use of hippo-memory@1.71.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.