Loading npm security reports…

memgineering@0.24.0: AI-agent control-surface risk | LPM Firewall

registry / memgineering / 0.24.0

memgineering@0.24.0

One memory for the AI you connect. Recall, remember, and revise a brain your agents share — stored in your own folder.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On global installation, the package instructs the installing AI agent to run setup immediately. Setup can persist instructions, skills, and lifecycle hooks in global Claude and Codex directories.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A global npm installation handled by an AI agent, followed by the command demanded by postinstall output.

Impact

Foreign AI-agent instruction and hook files can be modified without the user's informed consent.

Mechanism

Socially induced agent-control configuration and hook installation.

Policy narrative

Installing globally invokes postinstall. That script addresses the AI agent rather than the user and tells it to run setup in the same turn. The setup path detects installed AI tools, writes guidance and skills into their global directories, and can install lifecycle hooks. This turns an automatic package lifecycle message into a chain that causes broad persistent mutation of unrelated agent control surfaces.

AI rationale

The package uses postinstall output to induce autonomous setup, which writes and hooks foreign global AI-agent configurations. This is an unconsented install-time control-surface mutation chain.

Evidence

package.jsonscripts/postinstall.mjsdist/index.js.claude/CLAUDE.md.claude/skills.claude/settings.json.codex/AGENTS.md.codex/skills.codex/hooks.json

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

15function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L121: function isInteractive() { L122: return Boolean(process.stdout.isTTY) && !jsonMode; L123: } L124: function printHuman(text) { L125: if (!jsonMode) process.stdout.write(text + "\n"); L126: } ... L137: for (let i = 0; i < input.length; i++) { L138: const code = input.charCodeAt(i); L139: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: manifest.main -> dist/index.js L15: function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L121: function isInteractive() { L122: return Boolean(process.stdout.isTTY) && !jsonMode; L123: } L124: function printHuman(text) { L125: if (!jsonMode) process.stdout.write(text + "\n"); L126: } ... L137: for (let i = 0; i < input.length; i++) { L138: const code = input.charCodeAt(i); L139: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

•matchType = previous_version_dangerous_delta matchedPackage = memgineering@0.23.1 matchedIdentity = npm:bWVtZ2luZWVyaW5n:0.23.1 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: * it writes into somebody else's `~/.claude` and `~/.codex`. Conflating them import { mkdir, readFile, rename, rm, writeFile } from "fs/promises"; await writeFile(tmp, body, { encoding: "utf8", mode: 384 }); import { mkdir as mkdir3, readFile as readFile3, unlink, writeFile as writeFile2 } from "fs/promises"; await writeFile2(credentialsPath(), JSON.stringify(credentials, null, 2) + "\n", { import { mkdir as mkdir4, readFile as readFile4, unlink as unlink2, writeFile as writeFile3 } from "fs/promises"; await writeFile3(pendingLoginPath(), JSON.stringify(pending, null, 2) + "\n", { const base = args.baseUrl ?? apiUrl();

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

15Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L15: function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L121: function isInteractive() { L122: return Boolean(process.stdout.isTTY) && !jsonMode; L123: } L124: function printHuman(text) { L125: if (!jsonMode) process.stdout.write(text + "\n"); L126: } ... L137: for (let i = 0; i < input.length; i++) { L138: const code = input.charCodeAt(i); L139: if (code === 27 && input[i + 1] === "]" || code === 157) {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L15

Source & flagged code

7 flagged

package.jsonView file

Lines 17-57json

17 "memgineering": "bin/memgineering.js"

18 },

19 "main": "./dist/index.js",

20 "files": [

21 "bin",

22 "dist",

23 "assets",

24 "scripts",

25 "README.md",

26 "CHANGELOG.md",

27 "NOTICE"

28 ],

29 "scripts": {

30 "dev": "tsx src/index.ts",

31 "build": "tsup && rm -rf assets && mkdir -p assets && node scripts/copy-skills.mjs",

32 "typecheck": "tsc --noEmit",

33 "pretest": "pnpm build",

34 "test": "vitest run",

35 "test:unit": "vitest run",

36 "prepublishOnly": "pnpm build",

37 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 },

39 "dependencies": {

40 "@iarna/toml": "^2.2.5",

41 "commander": "^12.1.0",

42 "kleur": "^4.1.5",

43 "prompts": "^2.4.2",

44 "semver": "^7.8.4",

45 "string-width": "^7.2.0",

46 "yaml": "^2.9.0",

47 "zod": "^3.23.8"

48 },

49 "devDependencies": {

50 "@kordis/api-client": "workspace:*",

51 "@kordis/config": "workspace:*",

52 "@kordis/contracts": "workspace:*",

53 "@kordis/harness-schema": "workspace:*",

54 "@kordis/memory-engine": "workspace:*",

55 "@kordis/storage-adapter": "workspace:*",

56 "@kordis/translators": "workspace:*",

57 "@types/node": "^22.9.0",

dist/index.jsView file

15function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L121: function isInteractive() { L122: return Boolean(process.stdout.isTTY) && !jsonMode; L123: } L124: function printHuman(text) { L125: if (!jsonMode) process.stdout.write(text + "\n"); L126: } ... L137: for (let i = 0; i < input.length; i++) { L138: const code = input.charCodeAt(i); L139: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: manifest.main -> dist/index.js L15: function brandHome() { L16: return process.env[BRAND.homeEnvVar] ?? join(homedir(), BRAND.homeDirName); L17: } ... L121: function isInteractive() { L122: return Boolean(process.stdout.isTTY) && !jsonMode; L123: } L124: function printHuman(text) { L125: if (!jsonMode) process.stdout.write(text + "\n"); L126: } ... L137: for (let i = 0; i < input.length; i++) { L138: const code = input.charCodeAt(i); L139: if (code === 27 && input[i + 1] === "]" || code === 157) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

•matchType = previous_version_dangerous_delta matchedPackage = memgineering@0.23.1 matchedIdentity = npm:bWVtZ2luZWVyaW5n:0.23.1 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical