Loading npm security reports…

remem-mcp@0.6.1: AI-agent control-surface risk | LPM Firewall

registry / remem-mcp / 0.6.1

remem-mcp@0.6.1

Long-term memory for AI coding agents. Memory + CodeGraph + Wiki in one SQLite file. Auto-recall, auto-capture, no API key, no cloud.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On global npm installation, the package silently alters existing AI-agent configuration and lifecycle hooks. These hooks execute package commands during agent sessions and tool use.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g remem-mcp on a machine with a supported agent directory.

Impact

Persistence and execution in Claude, Devin, Cursor, Codex, and generic agent control surfaces.

Mechanism

postinstall-driven foreign agent MCP, hook, and skill registration.

Policy narrative

The postinstall hook runs automatically for global installs, detects AI-agent directories, and invokes setup without user confirmation. Setup registers the package as an MCP server, installs commands for session and Bash/exec lifecycle events, copies a skill into agent directories, and appends Codex configuration recommending broad sandbox access. This is unconsented postinstall mutation of foreign AI-agent control surfaces.

Rationale

Source confirms a guarded but automatic global postinstall chain that persists executable hooks across multiple third-party agent configurations. This meets the blocking policy for unconsented install-time mutation of a broad foreign AI-agent control surface.

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.claude.json~/.claude/settings.json~/.cursor/mcp.json~/.config/devin/mcp_config.json~/.config/devin/config.json~/.codex/config.toml

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

17import { L18: __dirname, L19: __toCommonJS, ... L83: try { L84: const obj = JSON.parse(trimmed); L85: if (obj.id) ids.add(obj.id); ... L266: init_esm_shims(); L267: import { execSync, spawn } from "child_process"; L268: import { createHash as createHash2 } from "crypto"; ... L288: for (const char of text) { L289: process.stdout.write(char); L290: await sleep(speed);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L17

17Trigger-reachable chain: scripts.start -> dist/index.js L17: import { L18: __dirname, L19: __toCommonJS, ... L83: try { L84: const obj = JSON.parse(trimmed); L85: if (obj.id) ids.add(obj.id); ... L266: init_esm_shims(); L267: import { execSync, spawn } from "child_process"; L268: import { createHash as createHash2 } from "crypto"; ... L288: for (const char of text) { L289: process.stdout.write(char); L290: await sleep(speed);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L17

266init_esm_shims(); L267: import { execSync, spawn } from "child_process"; L268: import { createHash as createHash2 } from "crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L266

634line(` ${C.gray}Starting viewer at localhost:7331...${C.reset}`); L635: const viewer = spawn("node", [indexPath, "viewer", "7331"], { L636: env: { ...process.env, REMEM_DB_PATH: dbPath }, L637: stdio: "ignore", ... L643: line(` ${C.bold}${C.cyan} CodeGraph \u2014 Live demo on facebook/react${C.reset}`); L644: line(` ${C.gray} Viewer: http://localhost:7331${C.reset}`); L645: line();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L634

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { existsSync as existsSync3, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs"; writeFileSync( writeFileSync( writeFileSync( writeFileSync(join3(dir, "src", "index.ts"), `const foo = "hello"; writeFileSync(join3(project, "src", "index.ts"), `const foo = "hello"; baseUrl; this.baseUrl = opts.baseUrl ?? "https://api.openai.com/v1";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs"; copyFileSync(dbPath, dbBackup); copyFileSync(walPath, join2(backupDir, `${basename(dbPath)}-wal`)); copyFileSync(shmPath, join2(backupDir, `${basename(dbPath)}-shm`)); copyFileSync(auditPath, auditBackup); import { existsSync as existsSync3, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs"; writeFileSync( writeFileSync(

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

17Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js L17: import { L18: __dirname, L19: __toCommonJS, ... L83: try { L84: const obj = JSON.parse(trimmed); L85: if (obj.id) ids.add(obj.id); ... L266: init_esm_shims(); L267: import { execSync, spawn } from "child_process"; L268: import { createHash as createHash2 } from "crypto"; ... L288: for (const char of text) { L289: process.stdout.write(char); L290: await sleep(speed);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L17

456} L457: execSync("npm install --silent 2>&1", { L458: cwd: dir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L456

scripts/perfection-loop.shView file

69Cross-file remote execution chain: scripts/perfection-loop.sh spawns dist/index.js; helper contains network access plus dynamic code execution. L69: ACTUAL_TOOLS=$(node --input-type=module -e " L70: import { spawn } from 'child_process'; L71: const p = spawn('node', ['dist/index.js'], { stdio: ['pipe', 'pipe', 'inherit'] }); L72: let buf = ''; L73: p.stdout.on('data', d => buf += d.toString()); L74: const req = JSON.stringify({jsonrpc:'2.0',id:1,method:'tools/list',params:{}}); L75: p.stdin.write('Content-Length: ' + Buffer.byteLength(req) + '\r\n\r\n' + req); L76: setTimeout(() => { ... L80: if (l.includes('\"tools\"')) { L81: const m = JSON.parse(l); L82: console.log(m.result.tools.length); ... L121: import os from 'os';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/perfection-loop.shView on unpkg · L69

scripts/dogfood-loop.shView file

•path = scripts/dogfood-loop.sh kind = build_helper sizeBytes = 6476 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dogfood-loop.shView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = remem-mcp@0.5.17 matchedPath = scripts/postinstall.js matchedIdentity = npm:cmVtZW0tbWNw:0.5.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 41-81json

41 ".": {

42 "import": "./dist/sdk.js"

43 }

44 },

45 "files": [

46 "dist",

47 "skills",

48 "scripts"

49 ],

50 "engines": {

51 "node": ">=22"

52 },

53 "scripts": {

54 "build": "tsup && mkdir -p dist/storage && cp src/storage/schema.sql dist/storage/schema.sql",

55 "dev": "tsup --watch",

56 "test": "vitest run",

57 "test:watch": "vitest",

58 "lint": "biome check src",

59 "format": "biome format --write src",

60 "start": "node dist/index.js",

61 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "prepublishOnly": "npm run build"

63 },

64 "dependencies": {

65 "@huggingface/transformers": "^4.2.0",

66 "@kreuzberg/tree-sitter-language-pack": "^1.10.9",

67 "@modelcontextprotocol/sdk": "^1.30.0",

68 "better-sqlite3": "^13.0.3",

69 "gpt-tokenizer": "^3.4.0",

70 "sqlite-vec": "^0.1.9",

71 "tree-sitter": "^0.25.1",

72 "ulid": "^3.0.2"

73 },

74 "devDependencies": {

75 "@biomejs/biome": "^2.5.7",

76 "@types/better-sqlite3": "^7.6.13",

77 "@types/node": "^22.0.0",

78 "tsup": "^8.5.1",

79 "typescript": "^5.5.0",

80 "vitest": "^4.1.10"

81 },

dist/index.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import {

3 LocalEmbedder,

4 Memory,

5 SQLiteBackend,

6 classifyGlobalContent,

7 findOutdatedPages,

8 getWikiPage,

9 ingestDirectory,

10 ingestFile,

11 init_local,

scripts/perfection-loop.shView file

Lines 49-89shell

49 ISSUES=$((ISSUES + TEST_FAILED))

50 echo "$TEST_OUTPUT" | grep "FAIL" | head -5

scripts/dogfood-loop.shView file

•path = scripts/dogfood-loop.sh kind = build_helper sizeBytes = 6476 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dogfood-loop.shView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = remem-mcp@0.5.17 matchedPath = scripts/postinstall.js matchedIdentity = npm:cmVtZW0tbWNw:0.5.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Lines 614-654javascript

614 await sleep(2e3);

615 line(` ${C.bold}${C.green} Your agent stops repeating the same mistakes.${C.reset}`);

616 line();

617 await sleep(2e3);

618 rmSync(tmpDir, { recursive: true, force: true });

619}

620async function demoCodegraph() {

621 const reactPath = "/Users/tin/a/react";

622 if (!existsSync3(reactPath)) {

623 console.error(`React repo not found at ${reactPath}`);

624 process.exit(1);

625 }

626 const dbPath = process.env.REMEM_DB_PATH ?? join3(homedir(), ".local", "share", "remem-mcp", "memory.db");

627 const distDir = dirname3(fileURLToPath2(import.meta.url));

628 const indexPath = join3(distDir, "index.js");

629 const cleanDb = new Database2(dbPath);

630 cleanDb.exec("DELETE FROM calls");

631 cleanDb.exec("DELETE FROM symbols");

632 cleanDb.exec("DELETE FROM imports");

633 cleanDb.close();

634 line(` ${C.gray}Starting viewer at localhost:7331...${C.reset}`);

635 const viewer = spawn("node", [indexPath, "viewer", "7331"], {

636 env: { ...process.env, REMEM_DB_PATH: dbPath },

637 stdio: "ignore",

638 detached: true

639 });

640 await sleep(1500);

641 clear();

642 banner();

643 line(` ${C.bold}${C.cyan} CodeGraph \u2014 Live demo on facebook/react${C.reset}`);

644 line(` ${C.gray} Viewer: http://localhost:7331${C.reset}`);

645 line();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L634

646 await sleep(2e3);

647 clear();

648 line(` ${C.bold}${C.cyan} Step 1: Index facebook/react${C.reset}`);

649 line(` ${C.gray} \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${C.reset}`);

650 line();

651 await sleep(1e3);

652 line(` ${C.gray}Indexing 1834 files with Tree-sitter...${C.reset}`);

653 await sleep(500);

654 await prompt(`remem-mcp index --path packages --repo .`);