hippo-memory@2.1.0

Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The postinstall behavior is limited to setup guidance and repair of a Codex wrapper already recorded as opted in. Agent integration and daily scheduling occur through the explicit init command, so the inspected scanner signals do not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Package installation triggers the postinstall module; running hippo init triggers integrations and daily scheduling.

Impact

No unconsented data transfer, harmful mutation, or other confirmed attack effect was found.

Mechanism

Postinstall checks installed-agent state and prints setup guidance. The init command performs integrations and scheduling, with skip options available.

AI rationale

Evidence

package.jsonscripts/postinstall.cjsdist/postinstall.jsdist/cli/init.jsdist/hooks/codex-wrapper.jsdist/capture/compaction-spool.jsdist/cli/install-steps.js

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares a postinstall hook that runs scripts/postinstall.cjs.
The postinstall module checks for existing agent installations, prints setup instructions, and only repairs a Codex wrapper when prior opt-in metadata exists.
The init command detects project agent files before adding integrations; its Codex integration offers an install command, while other hooks are installed through init.
The compaction spool uses local files to store and replay compaction summaries.
Daily scheduling is initiated by hippo init and can be skipped with --no-schedule or HIPPO_SKIP_SCHEDULE=1.

Evidence against

The package has a postinstall lifecycle hook that imports dist/postinstall.js.
The init flow can write agent configuration and create a daily schedule, but those actions are tied to an explicit CLI command.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Source & flagged code

5 flagged

package.jsonView file

Lines 30-70json

30 "bin",

31 "scripts/postinstall.cjs",

32 "openclaw.plugin.json",

33 "extensions/openclaw-plugin"

34 ],

35 "scripts": {

36 "baseline": "npm run build && npm test",

37 "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc && tsc -p tsconfig.benchmarks.json && tsc -p tsconfig.extensions.json",

38 "typecheck:tests": "tsc -p tsconfig.tests.json",

39 "check:dts": "node scripts/check-dts-diff.mjs",

40 "dev": "tsc --watch",

41 "pretest": "npm run build",

42 "test": "vitest run",

43 "test:watch": "vitest",

44 "test:coverage": "vitest run --coverage",

45 "test:delivery-ledger": "vitest run tests/delivery-ledger tests/migration-v55",

46 "test:eval": "vitest run --config vitest.eval.config.ts",

47 "lint": "oxlint",

48 "sbom": "node scripts/sbom.mjs",

49 "audit:security": "npm audit --audit-level=moderate && npm --prefix ui audit --audit-level=moderate",

50 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "smoke:pack": "node scripts/smoke-pack.mjs",

52 "smoke:openclaw-install": "node scripts/smoke-openclaw-install.mjs",

53 "build:ui": "cd ui && npm install && npm run build",

54 "build:all": "npm run build && npm run build:ui",

55 "version": "node scripts/sync-version.mjs && node scripts/check-manifest-versions.mjs && node scripts/check-expiring-keys-floor.mjs",

56 "prepublishOnly": "node scripts/check-manifest-versions.mjs && node scripts/check-expiring-keys-floor.mjs && node scripts/changelog-fragments.mjs check && node scripts/check-em-dashes-in-release-notes.mjs && node scripts/check-graph-writes.mjs && npm run build:all && node scripts/check-openclaw-dist.mjs && npm run smoke:openclaw-install && node scripts/check-tests-pass.mjs"

57 },

58 "keywords": [

59 "memory",

60 "agent-memory",

61 "ai-memory",

62 "llm-memory",

63 "long-term-memory",

64 "persistent-memory",

65 "memory-layer",

66 "mcp",

67 "mcp-server",

68 "model-context-protocol",

69 "claude-code",

70 "claude",

dist/embeddings/transformers.jsView file

Lines 1-26javascript

1// The optional Transformers.js package, and a bounded load of a model from it, shared by the local embedder and the

2// cross-encoder.

3import { MINUTE_MS } from '../util/time.js';

4import { createRequire } from 'node:module';

5import { pathToFileURL } from 'node:url';

dist/cli/scheduler.jsView file

30try { L31: const parsed = JSON.parse(text); L32: const workspaces = Array.isArray(parsed.workspaces) ... L74: } L75: // Crontab reads % as a newline and both shells expand $ and backtick; a backslash is a path separator on Windows only. L76: const UNSAFE_RUNNER_PATH_CHARS = /["`$%\n\r]/; ... L80: } L81: export function buildDailyRunnerCommand(projectDir, platform = process.platform) { L82: if (platform === 'win32') { ... L99: } L100: /** Argv for `schtasks`, passed without a shell: through cmd.exe the `&&` in /tr split the command. */ L101: export function buildSchtasksCreateArgs(taskName, cmd) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/scheduler.jsView on unpkg · L30

dist/capture/compaction-spool.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 14

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/capture/compaction-spool.js#virtual:normalized:round1View on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/embeddings/transformers.jsView file

6import { errorCode, errorMessage } from '../util/log.js'; L7: const _require = createRequire(import.meta.url); L8: // Importing both loads two onnxruntime-node builds whose finalizers can double-free on exit, so one is picked:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/embeddings/transformers.jsView on unpkg · L6

Findings

2 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/capture/compaction-spool.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/embeddings/transformers.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/scheduler.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to hippo-memory@2.1.0.

See all versions of hippo-memory for other recorded verdicts.

Review the evidence and your use of hippo-memory@2.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 11:25:08.945Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.