registry / memoryrouter-codex / 1.4.0
memoryrouter-codex@1.4.0
Automatic, project-scoped MemoryRouter memory for OpenAI Codex
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no npm install lifecycle hook, and its configuration changes require an explicit CLI command. Its automatic hooks, remote content transfer, and server-instructed detached Codex execution warrant a warning rather than a block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs `memoryrouter-codex init` with hooks enabled, then uses Codex.
Impact
A trusted service response can influence an unattended local agent run and receives captured conversation content.
Mechanism
Installed Codex hooks invoke remote memory APIs and launch server-instructed consolidation.
AI rationale
The package has no npm install lifecycle hook, and its configuration changes require an explicit CLI command. Its automatic hooks, remote content transfer, and server-instructed detached Codex execution warrant a warning rather than a block.
Evidence
lib/installer.cjslib/hooks.cjsruntime/hook.cjsruntime/auto.cjsruntime/reflect.cjsruntime/api.cjs~/.codex/config.toml~/.codex/hooks.json~/.codex/AGENTS.md~/.codex/memoryrouter/runtime<project>/.codex/config.toml<project>/.codex/hooks.json<project>/AGENTS.md<project>/.codex/memoryrouter/runtime~/.memoryrouter/codex
Network endpoints2
api.memoryrouter.aimcp.memoryrouter.ai/mcp
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit init command writes Codex MCP, hook, and AGENTS configuration.
- Installed hooks automatically start a detached background consolidation process when the API reports a suggestion.
- The background flow passes server-provided reflection instructions to `codex exec`.
- The runtime sends prompts and completed assistant messages to the MemoryRouter API when hooks are enabled.
Evidence against
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- Control-surface changes require the user to run `memoryrouter-codex init`; hooks and AGENTS changes can be disabled.
- The project MCP command pins the same package version rather than selecting an older release.
- No credential harvesting, obfuscated payload, or unrelated network endpoint was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedruntime/project.cjsView file
4const crypto = require('crypto');
L5: const { execFileSync } = require('child_process');
L6:
High
Child Process
Package source references child process execution.
runtime/project.cjsView on unpkg · L4lib/installer.cjsView file
124L125: function codexInfo(cwd, env = process.env) {
L126: try {
L127: const output = execFileSync('codex', ['--version'], { cwd, env, encoding: 'utf8', timeout: 5000 }).trim();
L128: return { installed: true, output, version: parseVersion(output) };
...
L135: try {
L136: const response = await fetch(url, { ...init, signal: controller.signal });
L137: let data = null;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/installer.cjsView on unpkg · L124•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
'use strict';
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execfilesync } = require('child_process');
const { codexhome, datahome, loadconfig, saveconfig, configpath } = require('../runtime/config.cjs');
const { resolveproject } = require('../runtime/project.cjs');
const { mcp_endpoint, integration_version } = require('../runtime/constants.cjs');
const {
installtoml, uninstalltoml, installagents, uninstallagents, readtext, replaceblock,
hasunmanagedmemoryroutertable, toml_start, toml_end, agents_start, agents_end,
} = require('./managed.cjs');
const { installhooks, uninstallhooks, isownedhook, managedgroups, parsehooks } = requir
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/installer.cjsView on unpkg64function init(options = {}) {
const layout = resolveLayout(options);
const auth = options.auth || 'oauth';
if (!['oauth', 'api-key'].includes(auth)) throw new Error('--auth must be oauth or api-key');
preflight(layout, options);
copyRuntime(layout.runtimeDir);
const results = [];
results.push(installToml(layout.configFile, { auth, scope: layout.scope, runtimeDir: layout.runtimeDir, force: options.force }));
if (options.hooks !== false) results.push(installHooks(layout.hooksFile, layout.runtimeDir, layout.scope));
if (options.agents !== false) results.push(installAgents(layout
Medium
Ai Review Evidence
The explicit init command writes Codex MCP, hook, and AGENTS configuration.
lib/installer.cjsView on unpkg · L64bin/cli.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = memoryrouter-codex@1.3.0
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.3.0
similarity = 0.857
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.cjsView on unpkgFindings
4 High3 Medium4 Low
HighChild Processruntime/project.cjs
HighSame File Env Network Executionlib/installer.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/installer.cjs
HighPrevious Version Dangerous Deltabin/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencelib/installer.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to memoryrouter-codex@1.4.0.
See all versions of memoryrouter-codex for other recorded verdicts.
- Review the evidence and your use of memoryrouter-codex@1.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.