registry / AI-agent control-surface risk / memgineering

memgineering

One memory for the AI you connect. Recall, remember, and revise a brain your agents share — stored in your own folder.

This report shows the evidence for memgineering@0.24.0. 3 of 35 known versions are blocked or flagged. The newest version, 0.27.0, is allowed. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package uses postinstall output to induce autonomous setup, which writes and hooks foreign global AI-agent configurations. This is an unconsented install-time control-surface mutation chain.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A global npm installation handled by an AI agent, followed by the command demanded by postinstall output.

Impact

Foreign AI-agent instruction and hook files can be modified without the user's informed consent.

Mechanism

Socially induced agent-control configuration and hook installation.

Policy narrative

Installing globally invokes postinstall. That script addresses the AI agent rather than the user and tells it to run setup in the same turn. The setup path detects installed AI tools, writes guidance and skills into their global directories, and can install lifecycle hooks. This turns an automatic package lifecycle message into a chain that causes broad persistent mutation of unrelated agent control surfaces.

AI rationale

The package uses postinstall output to induce autonomous setup, which writes and hooks foreign global AI-agent configurations. This is an unconsented install-time control-surface mutation chain.

Evidence

package.jsonscripts/postinstall.mjsdist/index.js.claude/CLAUDE.md.claude/skills.claude/settings.json.codex/AGENTS.md.codex/skills.codex/hooks.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest runs a postinstall script automatically.
The postinstall output directs an AI agent to run setup immediately.
Setup writes guidance and hooks into global Claude and Codex control files.
The setup command defaults unattended agent mode to enabling hooks.

Evidence against

The postinstall script does not directly modify files.
Credential requests are tied to an explicit hosted-account sign-in flow.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 949 KB of source, external domains: api.kordis.store, api.memgineering.com, memgineering.com, registry.npmjs.org, yamllint.com

Source & flagged code

7 flagged

package.jsonView file

Lines 17-57json

17 "memgineering": "bin/memgineering.js"

18 },

19 "main": "./dist/index.js",

20 "files": [

21 "bin",

22 "dist",

23 "assets",

24 "scripts",

25 "README.md",

26 "CHANGELOG.md",

27 "NOTICE"

28 ],

29 "scripts": {

30 "dev": "tsx src/index.ts",

31 "build": "tsup && rm -rf assets && mkdir -p assets && node scripts/copy-skills.mjs",

32 "typecheck": "tsc --noEmit",

33 "pretest": "pnpm build",

34 "test": "vitest run",

35 "test:unit": "vitest run",

36 "prepublishOnly": "pnpm build",

37 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 },

39 "dependencies": {

40 "@iarna/toml": "^2.2.5",

41 "commander": "^12.1.0",

42 "kleur": "^4.1.5",

43 "prompts": "^2.4.2",

44 "semver": "^7.8.4",

45 "string-width": "^7.2.0",

46 "yaml": "^2.9.0",

47 "zod": "^3.23.8"

48 },

49 "devDependencies": {

50 "@kordis/api-client": "workspace:*",

51 "@kordis/config": "workspace:*",

52 "@kordis/contracts": "workspace:*",

53 "@kordis/harness-schema": "workspace:*",

54 "@kordis/memory-engine": "workspace:*",

55 "@kordis/storage-adapter": "workspace:*",

56 "@kordis/translators": "workspace:*",

57 "@types/node": "^22.9.0",

dist/index.jsView file

15function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L121: function isInteractive() { L122: return Boolean(process.stdout.isTTY) && !jsonMode; L123: } L124: function printHuman(text) { L125: if (!jsonMode) process.stdout.write(text + "\n"); L126: } ... L137: for (let i = 0; i < input.length; i++) { L138: const code = input.charCodeAt(i); L139: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: manifest.main -> dist/index.js L15: function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L121: function isInteractive() { L122: return Boolean(process.stdout.isTTY) && !jsonMode; L123: } L124: function printHuman(text) { L125: if (!jsonMode) process.stdout.write(text + "\n"); L126: } ... L137: for (let i = 0; i < input.length; i++) { L138: const code = input.charCodeAt(i); L139: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

•matchType = previous_version_dangerous_delta matchedPackage = memgineering@0.23.1 matchedIdentity = npm:bWVtZ2luZWVyaW5n:0.23.1 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: * it writes into somebody else's `~/.claude` and `~/.codex`. Conflating them import { mkdir, readFile, rename, rm, writeFile } from "fs/promises"; await writeFile(tmp, body, { encoding: "utf8", mode: 384 }); import { mkdir as mkdir3, readFile as readFile3, unlink, writeFile as writeFile2 } from "fs/promises"; await writeFile2(credentialsPath(), JSON.stringify(credentials, null, 2) + "\n", { import { mkdir as mkdir4, readFile as readFile4, unlink as unlink2, writeFile as writeFile3 } from "fs/promises"; await writeFile3(pendingLoginPath(), JSON.stringify(pending, null, 2) + "\n", { const base = args.baseUrl ?? apiUrl();

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

15Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L15: function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L121: function isInteractive() { L122: return Boolean(process.stdout.isTTY) && !jsonMode; L123: } L124: function printHuman(text) { L125: if (!jsonMode) process.stdout.write(text + "\n"); L126: } ... L137: for (let i = 0; i < input.length; i++) { L138: const code = input.charCodeAt(i); L139: if (code === 27 && input[i + 1] === "]" || code === 157) {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L15

Findings

3 Critical3 High4 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltadist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to memgineering@0.24.0.

The versions list below shows the verdict for each recorded version.

Avoid installing memgineering@0.24.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-12 15:18:57.135Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

35 known versions

97%Malicious

AI assessment confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

This finding concerns changes to an AI agent's instructions or configuration without explicit user action. It does not by itself establish malware intent. The CLI warns by default and blocks when configured for this policy.

Package metadata

npm

Version0.24.0

PublishedSep 12, 2026

LicenseApache-2.0

Dependencies8

Integrityverified

Package size360 KB

Files17

Keywordsaimemoryagentmemory-engineeringclaude-codecodexsecond-brain

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jsbin → memgineering

Runtimenode >=20.0.0

Artifact1.21 MB · 17 files2 signature(s)

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Related packages

Other AI-agent control-surface risk packages

Source & flagged code