registry / memoryrouter-codex / 1.2.0
memoryrouter-codex@1.2.0
Automatic, project-scoped MemoryRouter memory for OpenAI Codex
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious by static inspection, but its explicit setup installs persistent Codex hooks that transmit conversation content to a remote service. This warrants a warning for agent extension lifecycle risk rather than a publication block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs memoryrouter-codex init, then Codex invokes an installed hook with a configured API key.
Impact
Project prompts and assistant responses may be transmitted to the configured remote memory service.
Mechanism
Explicit Codex extension setup with automatic memory capture and remote API submission.
AI rationale
The package is not malicious by static inspection, but its explicit setup installs persistent Codex hooks that transmit conversation content to a remote service. This warrants a warning for agent extension lifecycle risk rather than a publication block.
Evidence
package.jsonbin/cli.cjslib/installer.cjslib/hooks.cjslib/managed.cjsruntime/hook.cjsruntime/api.cjsruntime/constants.cjs~/.codex/config.toml~/.codex/hooks.json~/.codex/AGENTS.md<project>/.codex/config.toml<project>/.codex/hooks.json<project>/AGENTS.md~/.memoryrouter/codex/config.json
Network endpoints2
api.memoryrouter.aimcp.memoryrouter.ai/mcp
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- An explicit init command writes MCP configuration, hook configuration, and agent guidance into Codex-controlled locations.
- Installed hooks run on several Codex lifecycle events and capture completed prompts and assistant responses.
- Captured content is sent with a bearer token to the MemoryRouter API.
- Project API-key configuration can invoke the package again through npx at runtime.
Evidence against
- The manifest has no preinstall, install, or postinstall lifecycle script.
- Configuration changes require the user to run the init command.
- The hook does nothing when no API key is configured.
- No stealthy code loading, credential harvesting beyond the configured API key, or destructive behavior was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedruntime/project.cjsView file
4const crypto = require('crypto');
L5: const { execFileSync } = require('child_process');
L6:
High
Child Process
Package source references child process execution.
runtime/project.cjsView on unpkg · L4lib/installer.cjsView file
124L125: function codexInfo(cwd, env = process.env) {
L126: try {
L127: const output = execFileSync('codex', ['--version'], { cwd, env, encoding: 'utf8', timeout: 5000 }).trim();
L128: return { installed: true, output, version: parseVersion(output) };
...
L135: try {
L136: const response = await fetch(url, { ...init, signal: controller.signal });
L137: let data = null;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/installer.cjsView on unpkg · L124•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
'use strict';
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execfilesync } = require('child_process');
const { codexhome, datahome, loadconfig, saveconfig, configpath } = require('../runtime/config.cjs');
const { resolveproject } = require('../runtime/project.cjs');
const { mcp_endpoint, integration_version } = require('../runtime/constants.cjs');
const {
installtoml, uninstalltoml, installagents, uninstallagents, readtext, replaceblock,
hasunmanagedmemoryroutertable, toml_start, toml_end, agents_start, agents_end,
} = require('./managed.cjs');
const { installhooks, uninstallhooks, isownedhook, managedgroups, parsehooks } = requir
Findings
4 High3 Medium4 Low
HighChild Processruntime/project.cjs
HighSame File Env Network Executionlib/installer.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/installer.cjs
HighPrevious Version Dangerous Deltaruntime/reflect.cjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencelib/installer.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to memoryrouter-codex@1.2.0.
See all versions of memoryrouter-codex for other recorded verdicts.
- Review the evidence and your use of memoryrouter-codex@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.