Loading npm security reports…

memgineering@0.19.0: AI-agent control-surface risk | LPM Firewall

registry / memgineering / 0.19.0

memgineering@0.19.0

One memory for the AI you connect. Recall, remember, and revise a brain your agents share — stored in your own folder.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install emits instructions intended to make an AI agent immediately start browser-based setup. The follow-on setup can install persistent guidance and command hooks into global AI-agent configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A global npm installation whose postinstall output is read by an AI agent.

Impact

An agent may be induced to open a browser flow and install persistent commands and instructions into foreign global agent control surfaces without a direct user request.

Mechanism

Lifecycle-driven AI-agent coercion followed by global agent configuration and hook setup.

Policy narrative

Installing the package globally runs postinstall. That script addresses any AI agent reading the installer output and tells it to run browser-based setup immediately rather than present the command to the user. The setup path opens a browser, can keep a detached process waiting for completion, and is built to write global Claude and Codex instruction and hook files. This turns a package lifecycle message into a chain that can alter an AI agent's persistent control surface.

AI rationale

The package uses an automatic install hook to socially engineer an AI agent into a follow-on setup flow that persists commands and instructions in global agent configuration. This is a concrete lifecycle-driven AI control-surface hijack risk despite the postinstall script not writing those files itself.

Evidence

package.jsonscripts/postinstall.mjsdist/index.js~/.claude/CLAUDE.md~/.claude/settings.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

15function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L120: function isInteractive() { L121: return Boolean(process.stdout.isTTY) && !jsonMode; L122: } L123: function printHuman(text) { L124: if (!jsonMode) process.stdout.write(text + "\n"); L125: } ... L136: for (let i = 0; i < input.length; i++) { L137: const code = input.charCodeAt(i); L138: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: manifest.main -> dist/index.js L15: function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L120: function isInteractive() { L121: return Boolean(process.stdout.isTTY) && !jsonMode; L122: } L123: function printHuman(text) { L124: if (!jsonMode) process.stdout.write(text + "\n"); L125: } ... L136: for (let i = 0; i < input.length; i++) { L137: const code = input.charCodeAt(i); L138: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

•matchType = previous_version_dangerous_delta matchedPackage = memgineering@0.23.1 matchedIdentity = npm:bWVtZ2luZWVyaW5n:0.23.1 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: * it writes into somebody else's `~/.claude` and `~/.codex`. Conflating them import { mkdir, readFile, rename, rm, writeFile } from "fs/promises"; await writeFile(tmp, body, { encoding: "utf8", mode: 384 }); import { mkdir as mkdir3, readFile as readFile3, unlink, writeFile as writeFile2 } from "fs/promises"; await writeFile2(credentialsPath(), JSON.stringify(credentials, null, 2) + "\n", { import { mkdir as mkdir4, readFile as readFile4, unlink as unlink2, writeFile as writeFile3 } from "fs/promises"; await writeFile3(pendingLoginPath(), JSON.stringify(pending, null, 2) + "\n", { const base = args.baseUrl ?? apiUrl();

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

15Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L15: function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L120: function isInteractive() { L121: return Boolean(process.stdout.isTTY) && !jsonMode; L122: } L123: function printHuman(text) { L124: if (!jsonMode) process.stdout.write(text + "\n"); L125: } ... L136: for (let i = 0; i < input.length; i++) { L137: const code = input.charCodeAt(i); L138: if (code === 27 && input[i + 1] === "]" || code === 157) {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L15

•matchType = token_shingles matchedPackage = memgineering@0.18.3 matchedPath = dist/index.js matchedIdentity = npm:bWVtZ2luZWVyaW5n:0.18.3 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 17-57json

17 "memgineering": "bin/memgineering.js"

18 },

19 "main": "./dist/index.js",

20 "files": [

21 "bin",

22 "dist",

23 "assets",

24 "scripts",

25 "README.md",

26 "CHANGELOG.md",

27 "NOTICE"

28 ],

29 "scripts": {

30 "dev": "tsx src/index.ts",

31 "build": "tsup && rm -rf assets && mkdir -p assets && node scripts/copy-skills.mjs",

32 "typecheck": "tsc --noEmit",

33 "pretest": "pnpm build",

34 "test": "vitest run",

35 "test:unit": "vitest run",

36 "prepublishOnly": "pnpm build",

37 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 },

39 "dependencies": {

40 "@iarna/toml": "^2.2.5",

41 "commander": "^12.1.0",

42 "kleur": "^4.1.5",

43 "prompts": "^2.4.2",

44 "semver": "^7.8.4",

45 "string-width": "^7.2.0",

46 "yaml": "^2.9.0",

47 "zod": "^3.23.8"

48 },

49 "devDependencies": {

50 "@kordis/api-client": "workspace:*",

51 "@kordis/config": "workspace:*",

52 "@kordis/contracts": "workspace:*",

53 "@kordis/harness-schema": "workspace:*",

54 "@kordis/memory-engine": "workspace:*",

55 "@kordis/storage-adapter": "workspace:*",

56 "@types/node": "^22.9.0",

57 "@types/prompts": "^2.4.9",

dist/index.jsView file

15function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L120: function isInteractive() { L121: return Boolean(process.stdout.isTTY) && !jsonMode; L122: } L123: function printHuman(text) { L124: if (!jsonMode) process.stdout.write(text + "\n"); L125: } ... L136: for (let i = 0; i < input.length; i++) { L137: const code = input.charCodeAt(i); L138: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: manifest.main -> dist/index.js L15: function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L120: function isInteractive() { L121: return Boolean(process.stdout.isTTY) && !jsonMode; L122: } L123: function printHuman(text) { L124: if (!jsonMode) process.stdout.write(text + "\n"); L125: } ... L136: for (let i = 0; i < input.length; i++) { L137: const code = input.charCodeAt(i); L138: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

•matchType = previous_version_dangerous_delta matchedPackage = memgineering@0.23.1 matchedIdentity = npm:bWVtZ2luZWVyaW5n:0.23.1 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical