registry / memoryrouter-codex / 1.9.0
memoryrouter-codex@1.9.0
Automatic MemoryRouter memory for OpenAI Codex: one vault shared by every session, repo and tool, including Claude Code
AI Security Review
scanned 12h ago · by lpm-firewall-aiThe package's automatic capture is disclosed as its core feature and sends only the user's message and final assistant response to the MemoryRouter service. Setup is performed through an explicit CLI command, and the reviewed credential flows target MemoryRouter endpoints.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user invokes the CLI `init` command and configures/trusts its Codex hooks; there are no install lifecycle scripts.
Impact
Expected memory synchronization with the user's selected MemoryRouter vault; no unrelated collection or harmful behavior was identified.
Mechanism
Configured hooks recall from and save the user's prompt and final assistant response to MemoryRouter. The API key is sent to MemoryRouter endpoints.
AI rationale
The package's automatic capture is disclosed as its core feature and sends only the user's message and final assistant response to the MemoryRouter service. Setup is performed through an explicit CLI command, and the reviewed credential flows target MemoryRouter endpoints.
Evidence
~/.codex/config.toml~/.codex/hooks.json~/.codex/AGENTS.md~/.codex/memoryrouter/runtime/
Network endpoints3
api.memoryrouter.aiauth.memoryrouter.aimcp.memoryrouter.ai/mcp
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and declares no lifecycle scripts; installation behavior is invoked through the explicit `init` command.
- The documented integration automatically sends each user message and final assistant response to the user's MemoryRouter vault, and excludes tool output, reasoning, and intermediate messages.
- API requests send the supplied key to MemoryRouter's API endpoint; the vault-binding check sends it to MemoryRouter's auth endpoint.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedruntime/project.cjsView file
29const crypto = require('crypto');
L30: const { execFileSync } = require('child_process');
L31:
High
Child Process
Package source references child process execution.
runtime/project.cjsView on unpkg · L29•matchType = normalized_sha256
matchedPackage = memoryrouter-codex@1.8.2
matchedPath = runtime/project.cjs
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.8.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
runtime/project.cjsView on unpkglib/installer.cjsView file
174L175: function codexInfo(cwd, env = process.env) {
L176: try {
L177: const output = execFileSync('codex', ['--version'], { cwd, env, encoding: 'utf8', timeout: 5000 }).trim();
L178: return { installed: true, output, version: parseVersion(output) };
...
L185: try {
L186: const response = await fetch(url, { ...init, signal: controller.signal });
L187: let data = null;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/installer.cjsView on unpkg · L174•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
'use strict';
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execfilesync } = require('child_process');
const { codexhome, datahome, loadconfig, saveconfig, configpath, getapikey, apikeysource } = require('../runtime/config.cjs');
const { resolveproject } = require('../runtime/project.cjs');
const { mcp_endpoint, integration_version } = require('../runtime/constants.cjs');
const {
installtoml, uninstalltoml, installagents, uninstallagents, readtext, replaceblock,
hasunmanagedmemoryroutertable, externalremoteservername, toml_start, toml_end, agents_start, agents_end,
} = require('./managed.cjs');
const { installhooks, uninstallhooks
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/installer.cjsView on unpkg•matchType = normalized_sha256
matchedPackage = memoryrouter-codex@1.8.2
matchedPath = lib/installer.cjs
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.8.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/installer.cjsView on unpkgruntime/reflect.cjsView file
•matchType = normalized_sha256
matchedPackage = memoryrouter-codex@1.8.2
matchedPath = runtime/reflect.cjs
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.8.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
runtime/reflect.cjsView on unpkgbin/cli.cjsView file
•matchType = normalized_sha256
matchedPackage = memoryrouter-codex@1.8.2
matchedPath = bin/cli.cjs
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.8.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/cli.cjsView on unpkgruntime/auto.cjsView file
•matchType = normalized_sha256
matchedPackage = memoryrouter-codex@1.8.2
matchedPath = runtime/auto.cjs
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.8.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
runtime/auto.cjsView on unpkgruntime/import.cjsView file
•matchType = normalized_sha256
matchedPackage = memoryrouter-codex@1.8.2
matchedPath = runtime/import.cjs
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.8.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
runtime/import.cjsView on unpkgruntime/mcp-stdio.cjsView file
•matchType = token_shingles
matchedPackage = memoryrouter-codex@1.8.2
matchedPath = runtime/mcp-stdio.cjs
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.8.2
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
runtime/mcp-stdio.cjsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = memoryrouter-codex@1.8.1
matchedIdentity = npm:bWVtb3J5cm91dGVyLWNvZGV4:1.8.1
similarity = 0.875
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
runtime/mcp-stdio.cjsView on unpkgFindings
11 High2 Medium4 Low
HighChild Processruntime/project.cjs
HighSame File Env Network Executionlib/installer.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/installer.cjs
HighKnown Malware Source Similarityruntime/reflect.cjs
HighKnown Malware Source Similaritybin/cli.cjs
HighKnown Malware Source Similaritylib/installer.cjs
HighKnown Malware Source Similarityruntime/auto.cjs
HighKnown Malware Source Similarityruntime/import.cjs
HighKnown Malware Source Similarityruntime/project.cjs
HighKnown Malware Source Similarityruntime/mcp-stdio.cjs
HighPrevious Version Dangerous Deltaruntime/mcp-stdio.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to memoryrouter-codex@1.9.0.
See all versions of memoryrouter-codex for other recorded verdicts.
- Review the evidence and your use of memoryrouter-codex@1.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.