registry / memoryrouter-codex / 1.3.0
memoryrouter-codex@1.3.0
Automatic, project-scoped MemoryRouter memory for OpenAI Codex
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe code is not malicious under the install-control policy because there is no automatic npm lifecycle mutation and setup is explicitly user-invoked. It should be warned because it installs persistent Codex hooks that can upload conversation content and references a different runtime package release.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs memoryrouter-codex init and later uses Codex with the installed hooks and an API key.
Impact
Codex conversation content may be retained locally and uploaded to the configured MemoryRouter vault; the installer also creates a runtime npx dependency on an older release.
Mechanism
Explicit Codex extension setup with lifecycle memory capture and API upload.
AI rationale
The code is not malicious under the install-control policy because there is no automatic npm lifecycle mutation and setup is explicitly user-invoked. It should be warned because it installs persistent Codex hooks that can upload conversation content and references a different runtime package release.
Evidence
package.jsonbin/cli.cjslib/installer.cjslib/managed.cjslib/hooks.cjsruntime/hook.cjsruntime/memory.cjsruntime/api.cjs~/.codex/config.toml~/.codex/hooks.json~/.codex/AGENTS.md~/.codex/memoryrouter/runtime/<project>/.codex/config.toml<project>/.codex/hooks.json<project>/AGENTS.md<project>/.codex/memoryrouter/runtime/~/.memoryrouter/codex/config.json
Network endpoints2
api.memoryrouter.aimcp.memoryrouter.ai/mcp
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit init command installs an MCP configuration, hooks, and an AGENTS.md block into user or project Codex surfaces.
- Installed hooks run on prompt, stop, compaction, and session events.
- The hooks save prompts and assistant responses, then send scoped memory content to the package API when an API key is configured.
- Project-scope hook configuration invokes a different package release through npx at runtime.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Configuration mutation requires the user to run the init command.
- The hook exits without capture or network use when no API key is available.
- No obfuscation, credential harvesting beyond the configured API key, arbitrary shell execution, or unrelated endpoint was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedruntime/project.cjsView file
4const crypto = require('crypto');
L5: const { execFileSync } = require('child_process');
L6:
High
Child Process
Package source references child process execution.
runtime/project.cjsView on unpkg · L4lib/installer.cjsView file
124L125: function codexInfo(cwd, env = process.env) {
L126: try {
L127: const output = execFileSync('codex', ['--version'], { cwd, env, encoding: 'utf8', timeout: 5000 }).trim();
L128: return { installed: true, output, version: parseVersion(output) };
...
L135: try {
L136: const response = await fetch(url, { ...init, signal: controller.signal });
L137: let data = null;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/installer.cjsView on unpkg · L124•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
'use strict';
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execfilesync } = require('child_process');
const { codexhome, datahome, loadconfig, saveconfig, configpath } = require('../runtime/config.cjs');
const { resolveproject } = require('../runtime/project.cjs');
const { mcp_endpoint, integration_version } = require('../runtime/constants.cjs');
const {
installtoml, uninstalltoml, installagents, uninstallagents, readtext, replaceblock,
hasunmanagedmemoryroutertable, toml_start, toml_end, agents_start, agents_end,
} = require('./managed.cjs');
const { installhooks, uninstallhooks, isownedhook, managedgroups, parsehooks } = requir
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/installer.cjsView on unpkg64function init(options = {}) {
const layout = resolveLayout(options);
const auth = options.auth || 'oauth';
if (!['oauth', 'api-key'].includes(auth)) throw new Error('--auth must be oauth or api-key');
preflight(layout, options);
copyRuntime(layout.runtimeDir);
const results = [];
results.push(installToml(layout.configFile, { auth, scope: layout.scope, runtimeDir: layout.runtimeDir, force: options.force }));
if (options.hooks !== false) results.push(installHooks(layout.hooksFile, layout.runtimeDir, layout.scope));
if (options.agents !== false) results.push(installAgents(layout
Medium
Ai Review Evidence
The explicit init command installs an MCP configuration, hooks, and an AGENTS.md block into user or project Codex surfaces.
lib/installer.cjsView on unpkg · L64bin/cli.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = memoryrouter-codex@1.2.1
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.2.1
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.cjsView on unpkgFindings
4 High3 Medium4 Low
HighChild Processruntime/project.cjs
HighSame File Env Network Executionlib/installer.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/installer.cjs
HighPrevious Version Dangerous Deltabin/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencelib/installer.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to memoryrouter-codex@1.3.0.
See all versions of memoryrouter-codex for other recorded verdicts.
- Review the evidence and your use of memoryrouter-codex@1.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.