memnar@0.3.1
Plug Memnar into Claude Code with one command: your AI's memory, as a USB-stick.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package is not clearly malicious: its network behavior serves the stated memory feature and connection requires browser approval. However, the automatically installed session-end hook sends the full transcript to the service while relying on a server-side opt-in check, and the package does not establish that transcripts are withheld when learning is disabled; warn about this collection ambiguity.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs `memnar connect`, approves the browser pairing, and later ends a Claude Code session.
Impact
The service receives the full session transcript. The package does not show that transcript upload is skipped when automatic learning is disabled, leaving uncertainty about collection scope and consent.
Mechanism
The SessionEnd hook reads the transcript path from hook input and POSTs the transcript with the saved Memnar token to the capture endpoint; the source says opt-in is checked server-side.
AI rationale
The package is not clearly malicious: its network behavior serves the stated memory feature and connection requires browser approval. However, the automatically installed session-end hook sends the full transcript to the service while relying on a server-side opt-in check, and the package does not establish that transcripts are withheld when learning is disabled; warn about this collection ambiguity.
Evidence
index.jshooks/mindfile-session-end.shhooks/mindfile-session-start.sh~/.claude/settings.json~/.mindfile/token
Network endpoints2
app.memnar.aikvrwtxjayijgkamfnavy.supabase.co
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest describes Memnar as a Claude Code memory tool and defines no install lifecycle hook.
- The CLI starts its connection flow only when the user runs `connect`; that flow opens a browser for approval.
- The installed SessionEnd hook reads Claude Code’s transcript and POSTs it to the hosted capture endpoint, even though the script says the server checks whether learning is enabled.
- The CLI says to turn on automatic learning in Settings, but the package does not establish whether the full transcript is withheld from the service when learning is off.
Evidence against
- The connection flow requires browser approval before saving a token and installing hooks.
- The hook describes its purpose as extracting candidate patterns, scrubbing secrets, and checking opt-in server-side.
- The SessionStart hook only retrieves patterns from the configured Memnar service when a token exists.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggedindex.jsView file
12*/
L13: import { spawnSync, execFileSync } from "node:child_process";
L14: import { createHash, randomBytes } from "node:crypto";
High
12*/
L13: import { spawnSync, execFileSync } from "node:child_process";
L14: import { createHash, randomBytes } from "node:crypto";
...
L19:
L20: const WEB = process.env.MINDFILE_WEB_URL ?? "https://app.memnar.ai";
L21: const API = process.env.MINDFILE_API_URL ?? "https://kvrwtxjayijgkamfnavy.supabase.co";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.jsView on unpkg · L1212*/
L13: import { spawnSync, execFileSync } from "node:child_process";
L14: import { createHash, randomBytes } from "node:crypto";
...
L19:
L20: const WEB = process.env.MINDFILE_WEB_URL ?? "https://app.memnar.ai";
L21: const API = process.env.MINDFILE_API_URL ?? "https://kvrwtxjayijgkamfnavy.supabase.co";
...
L28: function openBrowser(url) {
L29: if (process.platform === "darwin") spawnSync("open", [url], { stdio: "ignore" });
L30: else if (process.platform === "win32") spawnSync("cmd", ["/c", "start", "", url], { stdio: "ignore" });
...
L40: } else {
L41: const dir = join(homedir(), ".mindfile");
L42: mkdirSync(dir, { recursive: true });
Findings
3 High5 Medium4 Low
HighChild Processindex.js
HighSame File Env Network Executionindex.js
HighSandbox Evasion Gated Capabilityindex.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/mindfile-session-end.sh
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to memnar@0.3.1.
See all versions of memnar for other recorded verdicts.
- Review the evidence and your use of memnar@0.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.