supermemory@5.0.1
The official TypeScript library for the Supermemory API
AI Security Review
scanned 29d ago · by lpm-firewall-aiInspected source supports explicit-command agent configuration changes, which the review policy assigns a warning. The scanner's blocking labels do not establish covert exfiltration or automatic malicious installation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user invokes plugin installation or plugin uninstall for selected agent targets.
Impact
Selected commands can change agent integrations and execute the latest integration installer; malicious intent or covert execution was not established.
Mechanism
The CLI executes selected integration installers through npx and edits OpenCode plugin configuration during removal, with dry-run guards.
AI rationale
Inspected source supports explicit-command agent configuration changes, which the review policy assigns a warning. The scanner's blocking labels do not establish covert exfiltration or automatic malicious installation.
Evidence
bin/cli.mjs.config/opencode/opencode.jsonc.config/opencode/opencode.json
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has only a publishing lifecycle hook and no runtime self-dependency.
- The plugin command requires target flags or interactive selection.
- The selected Codex installer runs codex-supermemory@latest through npx unless dry-run is enabled.
- The explicit OpenCode uninstall command edits its plugin configuration to remove Supermemory entries; dry-run prevents mutation.
Evidence against
- No automatic registry-install mutation was identified.
- Inspected command output is collected for local reporting, without an identified exfiltration sink.
- The remote shell installer belongs to explicit local-server commands and defaults to https://supermemory.ai/install.
- The inspected API credential handling uses configurable Supermemory API clients; no fixed unrelated credential recipient was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
12 flaggedbin/cli.mjsView file
174662// ../mono/apps/cli/src/lib/local-server.ts
L174663: import { spawn } from "node:child_process";
L174664: import { constants as fsConstants } from "node:fs";
L174665: import { access, readFile } from "node:fs/promises";
L174666: import { get as httpsGet } from "node:https";
L174667: import { homedir as homedir2 } from "node:os";
...
L174673: var TAG_URL_RE = /\/releases\/tag\/server-v([0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.]+)?)$/;
L174674: var INSTALL_URL = process.env.SUPERMEMORY_LOCAL_INSTALL_URL ?? "https://supermemory.ai/install";
L174675: var INSTALL_DIR = resolve4(process.env.SUPERMEMORY_INSTALL_DIR ?? join3(homedir2(), ".supermemory"));
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
bin/cli.mjsView on unpkg · L174662174652await runCommand(keysListCommand, { rawArgs });
L174653: process.stderr.write(`
L174654: ${source_default.dim("Available commands: list, create, revoke, toggle. Run supermemory keys --help for details.")}
...
L174662: // ../mono/apps/cli/src/lib/local-server.ts
L174663: import { spawn } from "node:child_process";
L174664: import { constants as fsConstants } from "node:fs";
L174665: import { access, readFile } from "node:fs/promises";
L174666: import { get as httpsGet } from "node:https";
L174667: import { homedir as homedir2 } from "node:os";
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
bin/cli.mjsView on unpkg · L174652Findings
4 Critical6 High5 Medium5 Low
CriticalSame File Env Network Executionbin/cli.mjs
CriticalCommand Output Exfiltrationbin/cli.mjs
CriticalDownload Executebin/cli.mjs
CriticalTrigger Reachable Dangerous Capabilitybin/cli.mjs
HighChild Processbin/cli.mjs
HighEntrypoint Build Divergencebin/cli.mjs
HighCredential Redirect Persistencebin/cli.mjs
HighSandbox Evasion Gated Capabilitybin/cli.mjs
HighTrigger Reachable Command Output Exfiltrationbin/cli.mjs
HighSemantic Analysis Limitedbin/cli.mjs
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to supermemory@5.0.1.
See all versions of supermemory for other recorded verdicts.
- Review the evidence and your use of supermemory@5.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.