registry / AI-agent control-surface risk / memgineering
memgineering
One memory for the AI you connect. Recall, remember, and revise a brain your agents share — stored in your own folder.
This report shows the evidence for memgineering@0.24.0. 3 of 35 known versions are blocked or flagged. The newest version, 0.27.0, is allowed. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package uses postinstall output to induce autonomous setup, which writes and hooks foreign global AI-agent configurations. This is an unconsented install-time control-surface mutation chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A global npm installation handled by an AI agent, followed by the command demanded by postinstall output.
Impact
Foreign AI-agent instruction and hook files can be modified without the user's informed consent.
Mechanism
Socially induced agent-control configuration and hook installation.
Policy narrative
Installing globally invokes postinstall. That script addresses the AI agent rather than the user and tells it to run setup in the same turn. The setup path detects installed AI tools, writes guidance and skills into their global directories, and can install lifecycle hooks. This turns an automatic package lifecycle message into a chain that causes broad persistent mutation of unrelated agent control surfaces.
AI rationale
The package uses postinstall output to induce autonomous setup, which writes and hooks foreign global AI-agent configurations. This is an unconsented install-time control-surface mutation chain.
Evidence
package.jsonscripts/postinstall.mjsdist/index.js.claude/CLAUDE.md.claude/skills.claude/settings.json.codex/AGENTS.md.codex/skills.codex/hooks.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest runs a postinstall script automatically.
- The postinstall output directs an AI agent to run setup immediately.
- Setup writes guidance and hooks into global Claude and Codex control files.
- The setup command defaults unattended agent mode to enabling hooks.
Evidence against
- The postinstall script does not directly modify files.
- Credential requests are tied to an explicit hosted-account sign-in flow.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
15function brandHome() {
L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName);
L17: }
...
L121: function isInteractive() {
L122: return Boolean(process.stdout.isTTY) && !jsonMode;
L123: }
L124: function printHuman(text) {
L125: if (!jsonMode) process.stdout.write(text + "\n");
L126: }
...
L137: for (let i = 0; i < input.length; i++) {
L138: const code = input.charCodeAt(i);
L139: if (code === 27 && input[i + 1] === "]" || code === 157) {
Critical
Credential Exfiltration
Findings
3 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to memgineering@0.24.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing memgineering@0.24.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.