Loading npm security reports…

remem-mcp@0.5.17: AI-agent control-surface risk | LPM Firewall

registry / remem-mcp / 0.5.17

remem-mcp@0.5.17

Long-term memory for AI coding agents. Memory + CodeGraph + Wiki in one SQLite file. Auto-recall, auto-capture, no API key, no cloud.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install silently mutates detected third-party AI-agent configurations. It registers this MCP server and persistent command hooks for agent and tool lifecycle events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

`npm install -g remem-mcp` on a non-CI host with a detected Claude, Devin, Cursor, or Codex configuration

Impact

Subsequent agent sessions and Bash/exec tool events invoke package-controlled commands.

Mechanism

postinstall-driven foreign AI-agent configuration and hook injection

Policy narrative

The package's npm postinstall runs automatically for global installation, detects installed AI-agent configuration directories, and silently runs `setup`. Setup registers remem-mcp as an MCP server and writes lifecycle command hooks into Claude, Devin, Cursor, and Codex configuration files. The hooks run package commands during session start/end, compaction, stop, and Bash/exec tool use. This is unconsented install-time mutation of foreign AI-agent control surfaces, creating persistence and command execution on later agent activity.

Rationale

Direct inspection confirms the critical behavior is the guarded but automatic postinstall mutation of multiple foreign AI-agent control surfaces. The scanner's fixed-gateway credential-exfiltration claim was not confirmed, but the install-time hook injection independently meets the block boundary.

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.claude.json~/.claude/settings.json~/.config/devin/mcp_config.json~/.config/devin/config.json

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

15import { L16: __dirname, L17: __toCommonJS, ... L80: try { L81: const obj = JSON.parse(trimmed); L82: if (obj.id) ids.add(obj.id); ... L263: init_esm_shims(); L264: import { execSync, spawn } from "child_process"; L265: import { createHash as createHash2 } from "crypto"; ... L285: for (const char of text) { L286: process.stdout.write(char); L287: await sleep(speed);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: scripts.start -> dist/index.js L15: import { L16: __dirname, L17: __toCommonJS, ... L80: try { L81: const obj = JSON.parse(trimmed); L82: if (obj.id) ids.add(obj.id); ... L263: init_esm_shims(); L264: import { execSync, spawn } from "child_process"; L265: import { createHash as createHash2 } from "crypto"; ... L285: for (const char of text) { L286: process.stdout.write(char); L287: await sleep(speed);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

263init_esm_shims(); L264: import { execSync, spawn } from "child_process"; L265: import { createHash as createHash2 } from "crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L263

818line(` ${C.gray}Starting viewer at localhost:7331...${C.reset}`); L819: const viewer = spawn("node", [indexPath, "viewer", "7331"], { L820: env: { ...process.env, TDAI_DB_PATH: dbPath }, L821: stdio: "ignore", ... L827: line(` ${C.bold}${C.cyan} CodeGraph \u2014 Live demo on facebook/react${C.reset}`); L828: line(` ${C.gray} Viewer: http://localhost:7331${C.reset}`); L829: line();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L818

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { existsSync as existsSync3, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs"; writeFileSync( writeFileSync( writeFileSync( writeFileSync(join3(dir, "src", "index.ts"), `const foo = "hello"; writeFileSync(join3(projectA, "src", "index.ts"), `const foo = "hello"; writeFileSync(join3(projectB, "src", "index.ts"), `const foo = "hello"; baseUrl;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs"; copyFileSync(dbPath, dbBackup); copyFileSync(walPath, join2(backupDir, `${basename(dbPath)}-wal`)); copyFileSync(shmPath, join2(backupDir, `${basename(dbPath)}-shm`)); copyFileSync(auditPath, auditBackup); import { existsSync as existsSync3, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs"; writeFileSync( writeFileSync(

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

15Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js L15: import { L16: __dirname, L17: __toCommonJS, ... L80: try { L81: const obj = JSON.parse(trimmed); L82: if (obj.id) ids.add(obj.id); ... L263: init_esm_shims(); L264: import { execSync, spawn } from "child_process"; L265: import { createHash as createHash2 } from "crypto"; ... L285: for (const char of text) { L286: process.stdout.write(char); L287: await sleep(speed);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L15

453} L454: execSync("npm install --silent 2>&1", { L455: cwd: dir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L453

scripts/postinstall.jsView file

6Cross-file remote execution chain: scripts/postinstall.js spawns dist/index.js; helper contains network access plus dynamic code execution. L6: */ L7: import { spawn } from "node:child_process"; L8: import { existsSync } from "node:fs"; ... L11: L12: // Only auto-setup on global install (npm[redacted] === "true") L13: // Skip in CI, tests, and local dev installs L14: const isGlobal = process.env.npm[redacted] === "true"; L15: const isCI = process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true"; L16: ... L23: const agentDirs = [ L24: join(homedir(), ".claude"), L25: join(homedir(), ".config", "devin"),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = tdai-memory-mcp@0.5.17 matchedPath = scripts/postinstall.js matchedIdentity = npm:dGRhaS1tZW1vcnktbWNw:0.5.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

scripts/cast-to-mp4.pyView file

•path = scripts/cast-to-mp4.py kind = build_helper sizeBytes = 8520 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cast-to-mp4.pyView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 41-81json

41 ".": {

42 "import": "./dist/sdk.js"

43 }

44 },

45 "files": [

46 "dist",

47 "skills",

48 "scripts"

49 ],

50 "engines": {

51 "node": ">=22"

52 },

53 "scripts": {

54 "build": "tsup && mkdir -p dist/storage && cp src/storage/schema.sql dist/storage/schema.sql",

55 "dev": "tsup --watch",

56 "test": "vitest run",

57 "test:watch": "vitest",

58 "lint": "biome check src",

59 "format": "biome format --write src",

60 "start": "node dist/index.js",

61 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "prepublishOnly": "npm run build"

63 },

64 "dependencies": {

65 "@huggingface/transformers": "^4.2.0",

66 "@kreuzberg/tree-sitter-language-pack": "^1.10.9",

67 "@modelcontextprotocol/sdk": "^1.30.0",

68 "better-sqlite3": "^13.0.3",

69 "gpt-tokenizer": "^3.4.0",

70 "sqlite-vec": "^0.1.9",

71 "tree-sitter": "^0.25.1",

72 "ulid": "^3.0.2"

73 },

74 "devDependencies": {

75 "@biomejs/biome": "^2.5.7",

76 "@types/better-sqlite3": "^7.6.13",

77 "@types/node": "^22.0.0",

78 "tsup": "^8.5.1",

79 "typescript": "^5.5.0",

80 "vitest": "^4.1.10"

81 }

dist/index.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2import {

3 LocalEmbedder,

4 Memory,

5 SQLiteBackend,

6 findOutdatedPages,

7 getWikiPage,

8 ingestDirectory,

9 ingestFile,

10 init_local,

11 local_exports,

12

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Postinstall script — runs automatically after `npm install -g remem-mcp`.

4 * Auto-registers MCP server + hooks in detected agent configs.

5 * Silent on failure (don't block npm install). Only runs on global install.

6 */

7import { spawn } from "node:child_process";

8import { existsSync } from

scripts/cast-to-mp4.pyView file

•path = scripts/cast-to-mp4.py kind = build_helper sizeBytes = 8520 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cast-to-mp4.pyView on unpkg

Lines 798-838javascript

798 await sleep(2e3);

799 line(` ${C.bold}${C.green} Your agent stops repeating the same mistakes.${C.reset}`);

800 line();

801 await sleep(3e3);

802 rmSync(tmpDir, { recursive: true, force: true });

803}

804async function demoCodegraph() {

805 const reactPath = "/Users/tin/a/react";

806 if (!existsSync3(reactPath)) {

807 console.error(`React repo not found at ${reactPath}`);

808 process.exit(1);

809 }

810 const dbPath = process.env.TDAI_DB_PATH ?? join3(homedir(), ".local", "share", "remem-mcp", "memory.db");

811 const distDir = dirname3(fileURLToPath2(import.meta.url));

812 const indexPath = join3(distDir, "index.js");

813 const cleanDb = new Database2(dbPath);

814 cleanDb.exec("DELETE FROM calls");

815 cleanDb.exec("DELETE FROM symbols");

816 cleanDb.exec("DELETE FROM imports");

817 cleanDb.close();

818 line(` ${C.gray}Starting viewer at localhost:7331...${C.reset}`);

819 const viewer = spawn("node", [indexPath, "viewer", "7331"], {

820 env: { ...process.env, TDAI_DB_PATH: dbPath },

821 stdio: "ignore",

822 detached: true

823 });

824 await sleep(1500);

825 clear();

826 banner();

827 line(` ${C.bold}${C.cyan} CodeGraph \u2014 Live demo on facebook/react${C.reset}`);

828 line(` ${C.gray} Viewer: http://localhost:7331${C.reset}`);

829 line();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L818

830 await sleep(2e3);

831 clear();

832 line(` ${C.bold}${C.cyan} Step 1: Index facebook/react${C.reset}`);

833 line(` ${C.gray} \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${C.reset}`);

834 line();

835 await sleep(1e3);

836 line(` ${C.gray}Indexing 1834 files with Tree-sitter...${C.reset}`);

837 await sleep(500);

838 await prompt(`remem-mcp index --path packages --repo .`);