registry / supermemory / 5.1.0
supermemory@5.1.0
The official TypeScript library for the Supermemory API
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged CLI behavior resolves to normal Supermemory API authentication and disclosed, opt-out command telemetry. No automatic credential forwarding, command-output exfiltration, or harmful install hook was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Telemetry follows an explicit CLI command; API requests follow user-invoked CLI operations.
Impact
No malicious impact identified.
Mechanism
Command metadata is posted to PostHog. Supermemory API authentication uses the configured API base, defaulting to the package’s own service.
AI rationale
The flagged CLI behavior resolves to normal Supermemory API authentication and disclosed, opt-out command telemetry. No automatic credential forwarding, command-output exfiltration, or harmful install hook was found.
Evidence
~/.supermemory/config.json
Network endpoints2
api.supermemory.aius.i.posthog.com/i/v0/e/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI is an explicit binary entry point; its only lifecycle script is `prepublishOnly` running the build.
- API credentials are sent through the CLI’s configured Supermemory API base, which defaults to `https://api.supermemory.ai`.
- Runtime telemetry is disclosed and can be disabled through configuration or `DO_NOT_TRACK`.
- Telemetry sends CLI command metadata to PostHog; the reviewed payload contains no API key, file contents, or paths.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
Source & flagged code
17 flaggedbin/cli.mjsView file
49// ../mono/node_modules/consola/dist/chunks/prompt.mjs
L50: import g, { stdin, stdout } from "node:process";
L51: import f from "node:readline";
...
L323: this._track && (this.value = this.rl?.line.replace(/\t/g, ""), this._cursor = this.rl?.cursor ?? 0, this.emit("value", this.value)), D();
L324: }, this.input.pipe(e), this.rl = f.createInterface({ input: this.input, output: e, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), f.emitKeypressEvents(this.input, this.rl), this...
L325: this.output.write(srcExports.cursor.show), this.output.off("resize", this.render), d$1(this.input, false), u(this.value);
...
L648: t.exports = u, u.eastAsianWidth = function(e) {
L649: var s = e.charCodeAt(0), i = e.length == 2 ? e.charCodeAt(1) : 0, D = s;
L650: return 55296 <= s && s <= 56319 && 56320
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bin/cli.mjsView on unpkg · L49175192await runCommand(keysListCommand, { rawArgs });
L175193: process.stderr.write(`
L175194: ${source_default.dim("Available commands: list, create, revoke, toggle. Run supermemory keys --help for details.")}
...
L175202: // ../mono/apps/cli/src/lib/local-server.ts
L175203: import { spawn } from "node:child_process";
L175204: import { constants as fsConstants } from "node:fs";
L175205: import { access, readFile } from "node:fs/promises";
L175206: import { get as httpsGet } from "node:https";
L175207: import { homedir as homedir2 } from "node:os";
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
Findings
4 Critical10 High6 Medium5 Low
CriticalCredential Exfiltrationbin/cli.mjs
CriticalCommand Output Exfiltrationbin/cli.mjs
CriticalTrigger Reachable Dangerous Capabilitybin/cli.mjs
CriticalPrevious Version Dangerous Deltadist/cjs/generated/core/file/file.js
HighChild Processbin/cli.mjs
HighShellbin/cli.mjs
HighEntrypoint Build Divergencebin/cli.mjs
HighSame File Env Network Executionbin/cli.mjs
HighCredential Redirect Persistencebin/cli.mjs
HighSandbox Evasion Gated Capabilitybin/cli.mjs
HighCross File Remote Execution Contextbin/cli.mjs
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to supermemory@5.1.0.
See all versions of supermemory for other recorded verdicts.
- Review the evidence and your use of supermemory@5.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.