registry / supermemory / 5.1.2
supermemory@5.1.2
The official TypeScript library for the Supermemory API
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential and process behavior belongs to the official Supermemory CLI: credentials are sent with requests to the configured Supermemory API, and the default runtime telemetry is disclosed with opt-out controls. The lifecycle hook only builds the package, and the inspected SDK entry point contains no suspicious import-time action.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
CLI API requests occur when the relevant command runs; telemetry is sent after a CLI command completes. The SDK exposes its client without suspicious import-time behavior in the inspected entry point.
Impact
No unauthorized credential transfer, command-output collection, or unrelated account action was identified.
Mechanism
The CLI sends its Supermemory credential to the configured API URL, defaulting to api.supermemory.ai. Runtime usage events go to PostHog with an anonymous ID and command metadata; the CLI gives notice and opt-out instructions.
AI rationale
The flagged credential and process behavior belongs to the official Supermemory CLI: credentials are sent with requests to the configured Supermemory API, and the default runtime telemetry is disclosed with opt-out controls. The lifecycle hook only builds the package, and the inspected SDK entry point contains no suspicious import-time action.
Evidence
package.jsonbin/cli.mjsdist/esm/index.js
Network endpoints6
api.supermemory.ai (default; configurable via SUPERMEMORY_API_URL)us.i.posthog.comgithub.com/supermemoryai/supermemory/releasesapi.github.com/repos/supermemoryai/supermemory/releasesraw.githubusercontent.com/supermemoryai/claude-supermemory/main/latest.jsonsupermemory.ai/install
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the CLI and SDK entry points; its only lifecycle script is prepublishOnly running the build.
- The CLI defaults to Supermemory’s API and accepts a user-configured API URL; it sends the Supermemory credential with requests to that configured service.
- CLI usage telemetry is disclosed, can be disabled, and uses a generated anonymous ID; the notice says it does not collect content, paths, or keys.
- Telemetry is sent to PostHog after a CLI command runs, not by an install hook or SDK import.
- The bundled CLI’s release and integration metadata requests use Supermemory’s GitHub repositories and official Supermemory hosts.
Evidence against
- The CLI handles saved or environment-provided credentials and sends default-on runtime telemetry, but the inspected flows route credentials to the configured Supermemory API and disclose the telemetry with opt-out controls.
- The package includes local-server process and download functionality, consistent with its CLI purpose and pointing to the project’s own GitHub releases.
Behavioral surface
Source & flagged code
16 flaggedbin/cli.mjsView file
49// ../mono/node_modules/consola/dist/chunks/prompt.mjs
L50: import g, { stdin, stdout } from "node:process";
L51: import f from "node:readline";
...
L323: this._track && (this.value = this.rl?.line.replace(/\t/g, ""), this._cursor = this.rl?.cursor ?? 0, this.emit("value", this.value)), D();
L324: }, this.input.pipe(e), this.rl = f.createInterface({ input: this.input, output: e, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), f.emitKeypressEvents(this.input, this.rl), this...
L325: this.output.write(srcExports.cursor.show), this.output.off("resize", this.render), d$1(this.input, false), u(this.value);
...
L648: t.exports = u, u.eastAsianWidth = function(e) {
L649: var s = e.charCodeAt(0), i = e.length == 2 ? e.charCodeAt(1) : 0, D = s;
L650: return 55296 <= s && s <= 56319 && 56320
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bin/cli.mjsView on unpkg · L49175192await runCommand(keysListCommand, { rawArgs });
L175193: process.stderr.write(`
L175194: ${source_default.dim("Available commands: list, create, revoke, toggle. Run supermemory keys --help for details.")}
...
L175202: // ../mono/apps/cli/src/lib/local-server.ts
L175203: import { spawn } from "node:child_process";
L175204: import { constants as fsConstants } from "node:fs";
L175205: import { access, readFile } from "node:fs/promises";
L175206: import { get as httpsGet } from "node:https";
L175207: import { homedir as homedir2 } from "node:os";
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
Findings
3 Critical10 High6 Medium5 Low
CriticalCredential Exfiltrationbin/cli.mjs
CriticalCommand Output Exfiltrationbin/cli.mjs
CriticalTrigger Reachable Dangerous Capabilitybin/cli.mjs
HighChild Processbin/cli.mjs
HighShellbin/cli.mjs
HighEntrypoint Build Divergencebin/cli.mjs
HighSame File Env Network Executionbin/cli.mjs
HighCredential Redirect Persistencebin/cli.mjs
HighSandbox Evasion Gated Capabilitybin/cli.mjs
HighCross File Remote Execution Contextbin/cli.mjs
HighTrigger Reachable Credential Exfiltrationbin/cli.mjs
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to supermemory@5.1.2.
See all versions of supermemory for other recorded verdicts.
- Review the evidence and your use of supermemory@5.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.