registry / hippo-memory / 1.72.0
hippo-memory@1.72.0
Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe suspicious static signals resolve to package-aligned setup behavior: postinstall does not install agent hooks, while CLI initialization performs integrations and scheduling. The added sleep-offload code is consistent with server sleep processing, with no concrete attack behavior found in the inspected source.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation invokes the manifest postinstall; agent hooks and scheduling are activated by running hippo init or setup.
Impact
No malicious behavior was established from the inspected sources; explicit CLI setup can modify agent configuration and create a daily schedule.
Mechanism
The postinstall checks for existing integration state and prints opt-in commands. CLI initialization detects existing agent markers, updates integration files, and may schedule the package's daily runner.
AI rationale
The suspicious static signals resolve to package-aligned setup behavior: postinstall does not install agent hooks, while CLI initialization performs integrations and scheduling. The added sleep-offload code is consistent with server sleep processing, with no concrete attack behavior found in the inspected source.
Evidence
package.jsonscripts/postinstall.cjsdist/postinstall.jsdist/cli/init.jsdist/cli/install-steps.jsdist/server/sleep-offload.js
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest postinstall invokes a small wrapper that imports the optional dist postinstall entry.
- The postinstall entry only attempts repair of an already-installed Codex wrapper and prints setup nudges; it does not itself install hooks into agent settings.
- Agent hook detection is based on existing agent marker files, and integration writes are reached through the CLI init flow.
- Daily scheduling is part of init/setup and can be skipped through an environment setting or CLI flag.
- The added sleep offload file runs sleep work in a child process with a deadline; it shows no unrelated payload or exfiltration behavior.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/embeddings/transformers.jsView file
5import { errorCode, errorMessage } from '../util/log.js';
L6: const _require = createRequire(import.meta.url);
L7: // Importing both loads two onnxruntime-node builds whose finalizers can double-free on exit, so one is picked:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/embeddings/transformers.jsView on unpkg · L5Findings
3 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/cli/install-steps.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/server/sleep-offload.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/embeddings/transformers.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/scheduler.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hippo-memory@1.72.0.
See all versions of hippo-memory for other recorded verdicts.
- Review the evidence and your use of hippo-memory@1.72.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.