Loading npm security reports…

remem-mcp@0.7.0: AI-agent control-surface risk | LPM Firewall

registry / remem-mcp / 0.7.0

remem-mcp@0.7.0

Long-term memory for AI coding agents. Memory + CodeGraph + Wiki in one SQLite file. Auto-recall, auto-capture, no API key, no cloud.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On global npm installation, the package silently modifies detected Claude, Devin, Cursor, and Codex agent configuration. It registers its MCP server and persistent lifecycle commands that run during agent sessions.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

`npm install -g remem-mcp` on a non-CI machine with a supported agent directory.

Impact

Future agent sessions execute package-controlled commands and load its MCP server without an explicit setup command.

Mechanism

postinstall-launched agent configuration and lifecycle-hook registration

Policy narrative

The postinstall hook detects global installation and existing agent directories, then invokes `setup` silently. Setup alters multiple unrelated AI-agent configuration surfaces, registering `npx -y remem-mcp` and lifecycle hooks that execute on session start, prompt submission, tool use, stop, and session end. This is unconsented install-time persistence across broad agent control surfaces.

Rationale

The source establishes an unconsented postinstall chain that mutates foreign AI-agent configs and installs recurring commands. This meets the firewall block boundary despite global-install and CI guards.

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.claude.json~/.claude/settings.json~/.config/devin/mcp_config.json~/.config/devin/config.json~/.cursor/mcp.json~/.codex/config.toml

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

34import { L35: __dirname, L36: __toCommonJS, ... L93: try { L94: const obj = JSON.parse(trimmed); L95: if (obj.id) ids.add(obj.id); ... L361: init_engine(); L362: import { execSync, spawn } from "child_process"; L363: import { createHash as createHash2 } from "crypto"; ... L383: for (const char of text) { L384: process.stdout.write(char); L385: await sleep(speed);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L34

34Trigger-reachable chain: scripts.start -> dist/index.js L34: import { L35: __dirname, L36: __toCommonJS, ... L93: try { L94: const obj = JSON.parse(trimmed); L95: if (obj.id) ids.add(obj.id); ... L361: init_engine(); L362: import { execSync, spawn } from "child_process"; L363: import { createHash as createHash2 } from "crypto"; ... L383: for (const char of text) { L384: process.stdout.write(char); L385: await sleep(speed);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L34

361init_engine(); L362: import { execSync, spawn } from "child_process"; L363: import { createHash as createHash2 } from "crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L361

732line(` ${C.gray}Starting viewer at localhost:7331...${C.reset}`); L733: const viewer = spawn("node", [indexPath, "viewer", "7331"], { L734: env: { ...process.env, REMEM_DB_PATH: dbPath }, L735: stdio: "ignore", ... L741: line(` ${C.bold}${C.cyan} CodeGraph \u2014 Live demo on facebook/react${C.reset}`); L742: line(` ${C.gray} Viewer: http://localhost:7331${C.reset}`); L743: line();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L732

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { existsSync as existsSync3, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs"; writeFileSync( writeFileSync( writeFileSync( writeFileSync(join3(dir, "src", "index.ts"), `const foo = "hello"; writeFileSync(join3(project, "src", "index.ts"), `const foo = "hello"; baseUrl; this.baseUrl = opts.baseUrl ?? "https://api.openai.com/v1";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs"; copyFileSync(dbPath, dbBackup); copyFileSync(walPath, join2(backupDir, `${basename(dbPath)}-wal`)); copyFileSync(shmPath, join2(backupDir, `${basename(dbPath)}-shm`)); copyFileSync(auditPath, auditBackup); import { existsSync as existsSync3, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs"; writeFileSync( writeFileSync(

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

34Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js L34: import { L35: __dirname, L36: __toCommonJS, ... L93: try { L94: const obj = JSON.parse(trimmed); L95: if (obj.id) ids.add(obj.id); ... L361: init_engine(); L362: import { execSync, spawn } from "child_process"; L363: import { createHash as createHash2 } from "crypto"; ... L383: for (const char of text) { L384: process.stdout.write(char); L385: await sleep(speed);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L34

551} L552: execSync("npm install --silent 2>&1", { L553: cwd: dir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L551

scripts/perfection-loop.shView file

69Cross-file remote execution chain: scripts/perfection-loop.sh spawns dist/index.js; helper contains network access plus dynamic code execution. L69: ACTUAL_TOOLS=$(node --input-type=module -e " L70: import { spawn } from 'child_process'; L71: const p = spawn('node', ['dist/index.js'], { stdio: ['pipe', 'pipe', 'inherit'] }); L72: let buf = ''; L73: p.stdout.on('data', d => buf += d.toString()); L74: const req = JSON.stringify({jsonrpc:'2.0',id:1,method:'tools/list',params:{}}); L75: p.stdin.write('Content-Length: ' + Buffer.byteLength(req) + '\r\n\r\n' + req); L76: setTimeout(() => { ... L80: if (l.includes('\"tools\"')) { L81: const m = JSON.parse(l); L82: console.log(m.result.tools.length); ... L121: import os from 'os';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/perfection-loop.shView on unpkg · L69

scripts/dogfood-loop.shView file

•path = scripts/dogfood-loop.sh kind = build_helper sizeBytes = 6476 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dogfood-loop.shView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = remem-mcp@0.6.3 matchedPath = scripts/postinstall.js matchedIdentity = npm:cmVtZW0tbWNw:0.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 41-81json

41 ".": {

42 "import": "./dist/sdk.js"

43 }

44 },

45 "files": [

46 "dist",

47 "skills",

48 "scripts"

49 ],

50 "engines": {

51 "node": ">=22"

52 },

53 "scripts": {

54 "build": "tsup && mkdir -p dist/storage && cp src/storage/schema.sql dist/storage/schema.sql",

55 "dev": "tsup --watch",

56 "test": "vitest run",

57 "test:watch": "vitest",

58 "lint": "biome check src",

59 "format": "biome format --write src",

60 "start": "node dist/index.js",

61 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "prepublishOnly": "npm run build"

63 },

64 "dependencies": {

65 "@huggingface/transformers": "^4.2.0",

66 "@kreuzberg/tree-sitter-language-pack": "^1.10.9",

67 "@modelcontextprotocol/sdk": "^1.30.0",

68 "better-sqlite3": "^13.0.3",

69 "gpt-tokenizer": "^3.4.0",

70 "sqlite-vec": "^0.1.9",

71 "ulid": "^3.0.2"

72 },

73 "devDependencies": {

74 "@biomejs/biome": "^2.5.7",

75 "@types/better-sqlite3": "^7.6.13",

76 "@types/node": "^22.0.0",

77 "tsup": "^8.5.1",

78 "typescript": "^5.5.0",

79 "vitest": "^4.1.10"

80 },

81 "overrides": {

dist/index.jsView file

34import { L35: __dirname, L36: __toCommonJS, ... L93: try { L94: const obj = JSON.parse(trimmed); L95: if (obj.id) ids.add(obj.id); ... L361: init_engine(); L362: import { execSync, spawn } from "child_process"; L363: import { createHash as createHash2 } from "crypto"; ... L383: for (const char of text) { L384: process.stdout.write(char); L385: await sleep(speed);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L34

34Trigger-reachable chain: scripts.start -> dist/index.js L34: import { L35: __dirname, L36: __toCommonJS, ... L93: try { L94: const obj = JSON.parse(trimmed); L95: if (obj.id) ids.add(obj.id); ... L361: init_engine(); L362: import { execSync, spawn } from "child_process"; L363: import { createHash as createHash2 } from "crypto"; ... L383: for (const char of text) { L384: process.stdout.write(char); L385: await sleep(speed);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L34

361init_engine(); L362: import { execSync, spawn } from "child_process"; L363: import { createHash as createHash2 } from "crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L361

scripts/perfection-loop.shView file

Lines 49-89shell

49 ISSUES=$((ISSUES + TEST_FAILED))

50 echo "$TEST_OUTPUT" | grep "FAIL" | head -5

scripts/dogfood-loop.shView file

•path = scripts/dogfood-loop.sh kind = build_helper sizeBytes = 6476 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dogfood-loop.shView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = remem-mcp@0.6.3 matchedPath = scripts/postinstall.js matchedIdentity = npm:cmVtZW0tbWNw:0.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg