memoryrouter-codex@1.8.2
Automatic MemoryRouter memory for OpenAI Codex: one vault shared by every session, repo and tool, including Claude Code
AI Security Review
scanned 1d ago · by lpm-firewall-aiA normal hook event can start paid `codex exec` work in the background by default, based on a server response and without per-run approval. The behavior is disclosed and bounded, but opting out is required; the review rules classify automatic spending as malicious.
Static reason
No blocking static signals were detected.
Trigger
After the user runs init and enables the hooks, a normal hook event triggers the action whenever the MemoryRouter service reports consolidation debt.
Impact
Unrequested inference usage may consume paid quota or incur costs. The code caps runs at three batches per trigger and applies cooldowns.
Mechanism
The hook spawns a detached reflect-auto process, which retrieves memory batches and invokes `codex exec` to create reflections. The user must opt out through configuration to prevent automatic runs.
Attack narrative
After the user installs and enables the hooks, a service-reported debt threshold can trigger detached background work without a per-run approval. That work runs `codex exec` using the user's inference quota. The package discloses this behavior and provides limits and an opt-out, but it is enabled by default and requires opting out to prevent the spend.
AI rationale
A normal hook event can start paid `codex exec` work in the background by default, based on a server response and without per-run approval. The behavior is disclosed and bounded, but opting out is required; the review rules classify automatic spending as malicious.
Evidence
runtime/hook.cjsruntime/auto.cjsruntime/reflect.cjsREADME.md/tmp/mrcodex-reflect-<pid>-<random>.txt~/.memoryrouter/consolidate.log~/.memoryrouter/consolidate.lock~/.memoryrouter/consolidate-state.json
Network endpoints1
api.memoryrouter.ai
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- Normal Codex hook events automatically start consolidation when the service reports debt; it is enabled by default.
- The hook starts a detached `reflect-auto` process without asking for per-run approval.
- That process runs `codex exec` to consolidate memories, consuming the user's inference quota.
- The README confirms this uses the user's paid inference and says users must opt out in config.
Evidence against
- The package has no install, preinstall, or postinstall lifecycle script.
- Memory API requests send the key and memory data to the package's own MemoryRouter service.
- The automatic run is disclosed, limited to three batches per trigger, and can be disabled in config.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedruntime/project.cjsView file
29const crypto = require('crypto');
L30: const { execFileSync } = require('child_process');
L31:
High
Child Process
Package source references child process execution.
runtime/project.cjsView on unpkg · L29lib/installer.cjsView file
174L175: function codexInfo(cwd, env = process.env) {
L176: try {
L177: const output = execFileSync('codex', ['--version'], { cwd, env, encoding: 'utf8', timeout: 5000 }).trim();
L178: return { installed: true, output, version: parseVersion(output) };
...
L185: try {
L186: const response = await fetch(url, { ...init, signal: controller.signal });
L187: let data = null;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/installer.cjsView on unpkg · L174•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
'use strict';
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execfilesync } = require('child_process');
const { codexhome, datahome, loadconfig, saveconfig, configpath, getapikey, apikeysource } = require('../runtime/config.cjs');
const { resolveproject } = require('../runtime/project.cjs');
const { mcp_endpoint, integration_version } = require('../runtime/constants.cjs');
const {
installtoml, uninstalltoml, installagents, uninstallagents, readtext, replaceblock,
hasunmanagedmemoryroutertable, externalremoteservername, toml_start, toml_end, agents_start, agents_end,
} = require('./managed.cjs');
const { installhooks, uninstallhooks
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/installer.cjsView on unpkgruntime/hook.cjsView file
110// Automatic consolidation (default on; config autoConsolidate: false opts
// out): detached fire-and-forget background run when the server says
// should-consolidate. Never blocks
High
Ai Review Evidence
Normal Codex hook events automatically start consolidation when the service reports debt; it is enabled by default.
runtime/hook.cjsView on unpkg · L110runtime/auto.cjsView file
147const child = spawner(process.execPath, [cliPath, 'reflect-auto'], {
detached: true,
stdio: ['ignore', out, out],
env: { ...env },
});
High
Ai Review Evidence
The hook starts a detached `reflect-auto` process without asking for per-run approval.
runtime/auto.cjsView on unpkg · L147runtime/reflect.cjsView file
88const result = spawnSync('codex', ['exec', '--sk[redacted]', '--output-last-message', outFile, prompt], {
encoding: 'utf8',
timeout: options.timeoutMs || 10 * 60 * 10
High
Ai Review Evidence
That process runs `codex exec` to consolidate memories, consuming the user's inference quota.
runtime/reflect.cjsView on unpkg · L88Findings
6 High2 Medium4 Low
HighChild Processruntime/project.cjs
HighSame File Env Network Executionlib/installer.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/installer.cjs
HighAi Review Evidenceruntime/hook.cjs
HighAi Review Evidenceruntime/auto.cjs
HighAi Review Evidenceruntime/reflect.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to memoryrouter-codex@1.8.2.
See all versions of memoryrouter-codex for other recorded verdicts.
- Avoid installing memoryrouter-codex@1.8.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.