supermemory@5.1.1
The official TypeScript library for the Supermemory API
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential and command-execution patterns do not establish exfiltration: credentials go to the configured Supermemory API, and the CLI’s shell installer is user-invoked. However, default-on telemetry includes project and account metadata beyond what its notice describes, so this version merits a telemetry warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When a user runs a CLI command; project metadata is added for setup commands.
Impact
Undisclosed project and account metadata is sent as runtime telemetry. No credential, file content, or command output exfiltration was identified.
Mechanism
The CLI posts command, runtime, account, and selected project-detection properties to https://us.i.posthog.com. It persists an anonymous telemetry ID and notice state in the user config.
AI rationale
The flagged credential and command-execution patterns do not establish exfiltration: credentials go to the configured Supermemory API, and the CLI’s shell installer is user-invoked. However, default-on telemetry includes project and account metadata beyond what its notice describes, so this version merits a telemetry warning.
Evidence
bin/cli.mjs~/.supermemory/config.json
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- CLI commands send runtime usage events to PostHog by default.
- Events can include detected project language, framework, AI SDK, package manager, and Supermemory package versions.
- The notice describes command names, versions, and OS, but does not mention the additional project and account fields.
- Telemetry can be disabled through the CLI config or DO_NOT_TRACK.
- The CLI’s default API URL is https://api.supermemory.ai; I found no fixed unofficial credential gateway.
Evidence against
- The manifest’s only lifecycle script is prepublishOnly, which runs the build.
- The telemetry code does not include credentials, file contents, command output, or project paths in the event properties.
- The event includes an anonymous ID and the user’s Supermemory organization ID, which is an ID assigned by the package’s own service.
- The CLI sends Supermemory API credentials to the configured API URL, defaulting to the official Supermemory API.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
16 flaggedbin/cli.mjsView file
49// ../mono/node_modules/consola/dist/chunks/prompt.mjs
L50: import g, { stdin, stdout } from "node:process";
L51: import f from "node:readline";
...
L323: this._track && (this.value = this.rl?.line.replace(/\t/g, ""), this._cursor = this.rl?.cursor ?? 0, this.emit("value", this.value)), D();
L324: }, this.input.pipe(e), this.rl = f.createInterface({ input: this.input, output: e, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), f.emitKeypressEvents(this.input, this.rl), this...
L325: this.output.write(srcExports.cursor.show), this.output.off("resize", this.render), d$1(this.input, false), u(this.value);
...
L648: t.exports = u, u.eastAsianWidth = function(e) {
L649: var s = e.charCodeAt(0), i = e.length == 2 ? e.charCodeAt(1) : 0, D = s;
L650: return 55296 <= s && s <= 56319 && 56320
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bin/cli.mjsView on unpkg · L49175192await runCommand(keysListCommand, { rawArgs });
L175193: process.stderr.write(`
L175194: ${source_default.dim("Available commands: list, create, revoke, toggle. Run supermemory keys --help for details.")}
...
L175202: // ../mono/apps/cli/src/lib/local-server.ts
L175203: import { spawn } from "node:child_process";
L175204: import { constants as fsConstants } from "node:fs";
L175205: import { access, readFile } from "node:fs/promises";
L175206: import { get as httpsGet } from "node:https";
L175207: import { homedir as homedir2 } from "node:os";
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
Findings
3 Critical10 High6 Medium5 Low
CriticalCredential Exfiltrationbin/cli.mjs
CriticalCommand Output Exfiltrationbin/cli.mjs
CriticalTrigger Reachable Dangerous Capabilitybin/cli.mjs
HighChild Processbin/cli.mjs
HighShellbin/cli.mjs
HighEntrypoint Build Divergencebin/cli.mjs
HighSame File Env Network Executionbin/cli.mjs
HighCredential Redirect Persistencebin/cli.mjs
HighSandbox Evasion Gated Capabilitybin/cli.mjs
HighCross File Remote Execution Contextbin/cli.mjs
HighTrigger Reachable Credential Exfiltrationbin/cli.mjs
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to supermemory@5.1.1.
See all versions of supermemory for other recorded verdicts.
- Review the evidence and your use of supermemory@5.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.