registry / memgineering / 0.12.0
memgineering@0.12.0
One memory for the AI you connect. Recall, remember, and revise a brain your agents share — stored in your own folder.
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection confirms a global-only postinstall message that steers an agent toward a later setup command, and setup can write persistent agent guidance. Because the inspected code makes configuration changes through the setup path and includes user-choice guidance, this warrants a warning for guarded agent setup capability, not a block for confirmed malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A global package installation prints the instructions; configuration changes require a subsequent setup command.
Impact
An agent may be steered to run setup, which can modify its configuration after the user chooses to proceed. No confirmed credential theft or covert configuration write was identified.
Mechanism
The setup path writes guidance into agent homes and installs skill files. The inspected code indicates user choices for agent setup and asks that automatic updates and hooks be decided with the user.
AI rationale
Source inspection confirms a global-only postinstall message that steers an agent toward a later setup command, and setup can write persistent agent guidance. Because the inspected code makes configuration changes through the setup path and includes user-choice guidance, this warrants a warning for guarded agent setup capability, not a block for confirmed malicious behavior.
Evidence
package.jsonscripts/postinstall.mjsdist/index.jsCLAUDE.md
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A package postinstall runs a script that prints instructions only for global installs; it does not run setup itself.
- The bundle describes persistent agent guidance in CLAUDE.md and setup can inject guidance into selected agent homes.
- The setup command exposes an explicit agent mode; source directs asking the user before choosing automatic updates or session hooks.
Evidence against
- The postinstall output says setup is not complete and asks the agent to ask the user before running it.
- The reviewed API client sends bearer tokens to the configured service URL; the default is the package’s own API host.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
15function brandHome() {
L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName);
L17: }
...
L118: function isInteractive() {
L119: return Boolean(process.stdout.isTTY) && !jsonMode;
L120: }
L121: function printHuman(text) {
L122: if (!jsonMode) process.stdout.write(text + "\n");
L123: }
...
L134: for (let i = 0; i < input.length; i++) {
L135: const code = input.charCodeAt(i);
L136: if (code === 27 && input[i + 1] === "]" || code === 157) {
Critical
Credential Exfiltration
Findings
3 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to memgineering@0.12.0.
See all versions of memgineering for other recorded verdicts.
- Review the evidence and your use of memgineering@0.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.