registry / remem-mcp / 0.6.8

remem-mcp@0.6.8

Long-term memory for AI coding agents. Memory + CodeGraph + Wiki in one SQLite file. Auto-recall, auto-capture, no API key, no cloud.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

The install lifecycle can modify existing AI-agent configurations without an explicit setup command. It registers the package and persistent command hooks that run during agent events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A global npm installation outside CI when a supported agent configuration directory exists.

Impact

Existing Claude Code, Devin CLI, Cursor, or Codex agent control surfaces can be altered and configured to execute package commands persistently.

Mechanism

postinstall launches setup, which registers MCP configuration, installs lifecycle hooks, and installs a skill; hooks invoke remem-mcp commands during agent sessions.

Attack narrative

Installing the package globally can automatically invoke its setup flow. That flow modifies supported AI-agent configuration and hook surfaces, causing remem-mcp commands to run on future session and tool events. The global-install and existing-directory guards reduce scope but do not provide explicit consent for this lifecycle-driven control-surface mutation.

AI rationale

This is an unconsented postinstall mutation of foreign AI-agent control surfaces with persistent command hooks. The qualifying guards do not remove the automatic lifecycle trigger.

Evidence

package.jsonscripts/postinstall.jsdist/index.js

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest runs a postinstall script automatically.
On qualifying global installs, the postinstall script launches the package binary with the setup command.
Setup automatically registers an MCP server, installs hooks, and installs a skill.
The installed hook configuration executes remem-mcp commands at agent session start and tool-use events.

Evidence against

Automatic setup is limited to global installs outside CI and only when an agent configuration directory exists.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 660 KB of source, external domains: 127.0.0.1, api.openai.com, fonts.googleapis.com, fonts.gstatic.com, github.com, www.w3.org

Source & flagged code

12 flagged

package.jsonView file

Lines 41-81json

41 ".": {

42 "import": "./dist/sdk.js"

43 }

44 },

45 "files": [

46 "dist",

47 "skills",

48 "scripts"

49 ],

50 "engines": {

51 "node": ">=22"

52 },

53 "scripts": {

54 "build": "tsup && mkdir -p dist/storage && cp src/storage/schema.sql dist/storage/schema.sql",

55 "dev": "tsup --watch",

56 "test": "vitest run",

57 "test:watch": "vitest",

58 "lint": "biome check src",

59 "format": "biome format --write src",

60 "start": "node dist/index.js",

61 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "prepublishOnly": "npm run build"

63 },

64 "dependencies": {

65 "@huggingface/transformers": "^4.2.0",

66 "@kreuzberg/tree-sitter-language-pack": "^1.10.9",

67 "@modelcontextprotocol/sdk": "^1.30.0",

68 "better-sqlite3": "^13.0.3",

69 "gpt-tokenizer": "^3.4.0",

70 "sqlite-vec": "^0.1.9",

71 "ulid": "^3.0.2"

72 },

73 "devDependencies": {

74 "@biomejs/biome": "^2.5.7",

75 "@types/better-sqlite3": "^7.6.13",

76 "@types/node": "^22.0.0",

77 "tsup": "^8.5.1",

78 "typescript": "^5.5.0",

79 "vitest": "^4.1.10"

80 },

81 "overrides": {

dist/index.jsView file

30import { L31: __dirname, L32: __require, ... L89: try { L90: const obj = JSON.parse(trimmed); L91: if (obj.id) ids.add(obj.id); ... L357: init_engine(); L358: import { execSync, spawn } from "child_process"; L359: import { createHash as createHash2 } from "crypto"; ... L379: for (const char of text) { L380: process.stdout.write(char); L381: await sleep(speed);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L30

30Trigger-reachable chain: scripts.start -> dist/index.js L30: import { L31: __dirname, L32: __require, ... L89: try { L90: const obj = JSON.parse(trimmed); L91: if (obj.id) ids.add(obj.id); ... L357: init_engine(); L358: import { execSync, spawn } from "child_process"; L359: import { createHash as createHash2 } from "crypto"; ... L379: for (const char of text) { L380: process.stdout.write(char); L381: await sleep(speed);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L30

357init_engine(); L358: import { execSync, spawn } from "child_process"; L359: import { createHash as createHash2 } from "crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L357

scripts/perfection-loop.shView file

Lines 49-89shell

49 ISSUES=$((ISSUES + TEST_FAILED))

50 echo "$TEST_OUTPUT" | grep "FAIL" | head -5

scripts/dogfood-loop.shView file

•path = scripts/dogfood-loop.sh kind = build_helper sizeBytes = 6476 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dogfood-loop.shView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = remem-mcp@0.7.3 matchedPath = scripts/postinstall.js matchedIdentity = npm:cmVtZW0tbWNw:0.7.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L30

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L30

357init_engine(); L358: import { execSync, spawn } from "child_process"; L359: import { createHash as createHash2 } from "crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L357

725line(` ${C.gray}Starting viewer at localhost:7331...${C.reset}`); L726: const viewer = spawn("node", [indexPath, "viewer", "7331"], { L727: env: { ...process.env, REMEM_DB_PATH: dbPath }, L728: stdio: "ignore", ... L734: line(` ${C.bold}${C.cyan} CodeGraph \u2014 Live demo on facebook/react${C.reset}`); L735: line(` ${C.gray} Viewer: http://localhost:7331${C.reset}`); L736: line();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L725

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { existsSync as existsSync3, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs"; writeFileSync( writeFileSync( writeFileSync( writeFileSync(join3(dir, "src", "index.ts"), `const foo = "hello"; writeFileSync(join3(project, "src", "index.ts"), `const foo = "hello"; baseUrl; this.baseUrl = opts.baseUrl ?? "https://api.openai.com/v1";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

30Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js L30: import { L31: __dirname, L32: __require, ... L89: try { L90: const obj = JSON.parse(trimmed); L91: if (obj.id) ids.add(obj.id); ... L357: init_engine(); L358: import { execSync, spawn } from "child_process"; L359: import { createHash as createHash2 } from "crypto"; ... L379: for (const char of text) { L380: process.stdout.write(char); L381: await sleep(speed);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L30

547} L548: execSync("npm install --silent 2>&1", { L549: cwd: dir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L547

scripts/perfection-loop.shView file

69Cross-file remote execution chain: scripts/perfection-loop.sh spawns dist/index.js; helper contains network access plus dynamic code execution. L69: ACTUAL_TOOLS=$(node --input-type=module -e " L70: import { spawn } from 'child_process'; L71: const p = spawn('node', ['dist/index.js'], { stdio: ['pipe', 'pipe', 'inherit'] }); L72: let buf = ''; L73: p.stdout.on('data', d => buf += d.toString()); L74: const req = JSON.stringify({jsonrpc:'2.0',id:1,method:'tools/list',params:{}}); L75: p.stdin.write('Content-Length: ' + Buffer.byteLength(req) + '\r\n\r\n' + req); L76: setTimeout(() => { ... L80: if (l.includes('\"tools\"')) { L81: const m = JSON.parse(l); L82: console.log(m.result.tools.length); ... L121: import os from 'os';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/perfection-loop.shView on unpkg · L69

scripts/dogfood-loop.shView file

•path = scripts/dogfood-loop.sh kind = build_helper sizeBytes = 6476 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dogfood-loop.shView on unpkg

scripts/postinstall.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Findings

2 Critical9 High5 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighCredential Redirect Persistencedist/index.js

HighCross File Remote Execution Contextscripts/perfection-loop.sh

HighTrigger Reachable Credential Exfiltrationdist/index.js

HighRuntime Package Installdist/index.js

HighKnown Malware Source Similarityscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/dogfood-loop.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to remem-mcp@0.6.8.

See version security history for other recorded verdicts.

Avoid installing remem-mcp@0.6.8. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-20 20:37:52.978Z (UTC).