registry / memoryrouter-codex / 1.5.0
memoryrouter-codex@1.5.0
Automatic, project-scoped MemoryRouter memory for OpenAI Codex
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no npm lifecycle trigger, but its explicit init command configures a broad Codex hook surface that automatically transmits conversation content when credentials are present. This is a guarded first-party agent extension risk, not confirmed malware.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs memoryrouter-codex init and later uses Codex with hooks enabled and an API key available.
Impact
User prompts and final assistant responses can be retained by the configured remote memory service.
Mechanism
User-invoked Codex hook installation with authenticated memory capture.
AI rationale
The package has no npm lifecycle trigger, but its explicit init command configures a broad Codex hook surface that automatically transmits conversation content when credentials are present. This is a guarded first-party agent extension risk, not confirmed malware.
Evidence
package.jsonbin/cli.cjslib/installer.cjslib/hooks.cjslib/managed.cjsruntime/hook.cjsruntime/memory.cjsruntime/api.cjs~/.codex/config.toml~/.codex/hooks.json~/.codex/AGENTS.md.codex/config.toml.codex/hooks.jsonAGENTS.md~/.memoryrouter/codex/
Network endpoints2
api.memoryrouter.aimcp.memoryrouter.ai/mcp
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit init command writes managed Codex configuration, hooks, and AGENTS guidance.
- Installed hooks run at session, prompt, stop, compaction, and session-end events.
- Hook capture sends saved prompts and final assistant responses to the configured memory service.
- Requests use a supplied API key and send JSON to the MemoryRouter API.
Evidence against
- package.json has no npm preinstall, install, postinstall, or other install lifecycle hook.
- The control-surface changes require the user to run the init command.
- Hooks do nothing when no MemoryRouter API key is available.
- No hidden payload, arbitrary shell execution, credential harvesting, or unrelated network endpoint was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedruntime/project.cjsView file
4const crypto = require('crypto');
L5: const { execFileSync } = require('child_process');
L6:
High
Child Process
Package source references child process execution.
runtime/project.cjsView on unpkg · L4lib/installer.cjsView file
124L125: function codexInfo(cwd, env = process.env) {
L126: try {
L127: const output = execFileSync('codex', ['--version'], { cwd, env, encoding: 'utf8', timeout: 5000 }).trim();
L128: return { installed: true, output, version: parseVersion(output) };
...
L135: try {
L136: const response = await fetch(url, { ...init, signal: controller.signal });
L137: let data = null;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/installer.cjsView on unpkg · L124•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
'use strict';
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execfilesync } = require('child_process');
const { codexhome, datahome, loadconfig, saveconfig, configpath } = require('../runtime/config.cjs');
const { resolveproject } = require('../runtime/project.cjs');
const { mcp_endpoint, integration_version } = require('../runtime/constants.cjs');
const {
installtoml, uninstalltoml, installagents, uninstallagents, readtext, replaceblock,
hasunmanagedmemoryroutertable, toml_start, toml_end, agents_start, agents_end,
} = require('./managed.cjs');
const { installhooks, uninstallhooks, isownedhook, managedgroups, parsehooks } = requir
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/installer.cjsView on unpkg69copyRuntime(layout.runtimeDir);
const results = [];
results.push(installToml(layout.configFile, { auth, scope: layout.scope, runtimeDir: layout.runtimeDir, force: options.force }));
if (options.hooks !== false) results.push(installHooks(layout.hooksFile, layout.runtimeDir, layout.scope));
if (options.agents !== false) results.push(installAgents(layout.agentsFile));
Medium
Ai Review Evidence
The explicit init command writes managed Codex configuration, hooks, and AGENTS guidance.
lib/installer.cjsView on unpkg · L69runtime/mcp-stdio.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = memoryrouter-codex@1.4.0
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.4.0
similarity = 0.867
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
runtime/mcp-stdio.cjsView on unpkglib/hooks.cjsView file
52return {
SessionStart: [{ matcher: 'startup|resume|clear|compact', hooks: [handler('session-start', 8, 'Recalling MemoryRouter context', 3500)] }],
UserPromptSubmit: [{ hooks: [handler('inject', 8, 'Searching project memory', 3500)] }],
Stop: [{ hooks: [handler('capture', 18, 'Saving durable project memory')] }],
SubagentStop: [{ hooks: [handler('capture-subagent', 15, 'Saving durable subagent outcome')] }],
PreCompact: [{ matcher: 'manual|auto', hooks: [handler('flush', 18, 'Saving memory before compaction')] }],
SessionEnd: [{ hooks: [handler('flush', 3)] }],
};
Medium
Ai Review Evidence
Installed hooks run at session, prompt, stop, compaction, and session-end events.
lib/hooks.cjsView on unpkg · L52Findings
4 High4 Medium4 Low
HighChild Processruntime/project.cjs
HighSame File Env Network Executionlib/installer.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/installer.cjs
HighPrevious Version Dangerous Deltaruntime/mcp-stdio.cjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencelib/installer.cjs
MediumAi Review Evidencelib/hooks.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to memoryrouter-codex@1.5.0.
See all versions of memoryrouter-codex for other recorded verdicts.
- Review the evidence and your use of memoryrouter-codex@1.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.