registry / AI-agent control-surface risk / tdai-memory-mcp

tdai-memory-mcp

Long-term memory for AI coding agents. Memory + CodeGraph + Wiki in one SQLite file. Auto-recall, auto-capture, no API key, no cloud.

This report shows the evidence for tdai-memory-mcp@0.5.17. 4 of 17 known versions are blocked or flagged. The newest version, 0.5.18, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, not merely an explicit setup feature. Optional LLM networking is not needed for the blocking finding.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm global install with an existing .claude, .codex, .cursor, or Devin configuration

Impact

Changes agent control surfaces and causes later agent sessions to execute package hooks that ingest transcript and command-error content.

Mechanism

Postinstall-driven cross-agent MCP registration and hook injection

Policy narrative

On a qualifying global install, postinstall launches `dist/index.js setup` without an explicit user setup command. Setup adds npx-backed MCP entries to detected third-party agent configurations and injects commands at session and tool lifecycle events. Those hooks later capture agent transcript summaries and failed-command output into package storage.

AI rationale

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, not merely an explicit setup feature. Optional LLM networking is not needed for the blocking finding.

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.claude.json~/.claude/settings.json~/.config/devin/mcp_config.json~/.config/devin/config.json~/.cursor/mcp.json~/.codex/config.toml~/.local/share/tdai-memory-mcp/memory.db

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall automatically.
scripts/postinstall.js runs setup on global installs when agent directories exist.
dist/index.js setup edits Claude, Devin, Cursor, and Codex MCP configurations.
dist/index.js installs Claude/Devin/Codex lifecycle hooks without user command.
Hooks capture command errors and session transcripts into a local database.

Evidence against

No fixed non-local exfiltration endpoint was found.
OpenAI-compatible requests require an explicit API key and configured command.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 274 KB of source, external domains: api.openai.com, fonts.googleapis.com, fonts.gstatic.com, github.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tdai-memory-mcp@0.5.11 matchedIdentity = npm:dGRhaS1tZW1vcnktbWNw:0.5.11 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

676// src/doctor.ts L677: import { execFileSync } from "child_process"; L678: import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L676

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: baseUrl; this.baseUrl = opts.baseUrl ?? "https://api.openai.com/v1"; const url = `${this.baseUrl}/chat/completions`; Authorization: `Bearer ${this.apiKey}` const baseUrl = process.env.TDAI_LLM_BASE_URL ?? "https://api.openai.com/v1"; const llmClient = new OpenAILLMClient({ apiKey, baseUrl, model }); const baseUrl = env.TDAI_LLM_BASE_URL ?? file?.llm?.baseUrl; baseUrl: baseUrl ?? "https://api.openai.com/v1",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs"; copyFileSync(dbPath, dbBackup); copyFileSync(walPath, join2(backupDir, `${basename(dbPath)}-wal`)); copyFileSync(shmPath, join2(backupDir, `${basename(dbPath)}-shm`)); copyFileSync(auditPath, auditBackup); return `Extract 1-3 atomic facts from the following ${type}. Each fact must be: this.baseUrl = opts.baseUrl ?? "https://api.openai.com/v1"; const baseUrl = process.env.TDAI_LLM_BASE_URL ?? "https://api.openai.com/v1";

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

733try { L734: binPath = execFileSync("which", ["tdai-memory-mcp"], { encoding: "utf-8" }).trim(); L735: checks.push({ ok: true, detail: `Binary: ${binPath}` }); L736: } catch { L737: checks.push({ ok: false, detail: "Binary: not in PATH (npx will be used)" }); L738: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L733

•matchType = normalized_sha256 matchedPackage = tdai-memory-mcp@0.5.13 matchedPath = dist/index.js matchedIdentity = npm:dGRhaS1tZW1vcnktbWNw:0.5.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

scripts/postinstall.jsView file

6Cross-file remote execution chain: scripts/postinstall.js spawns dist/index.js; helper contains network access plus dynamic code execution. L6: */ L7: import { spawn } from "node:child_process"; L8: import { existsSync } from "node:fs"; ... L11: L12: // Only auto-setup on global install (npm[redacted] === "true") L13: // Skip in CI, tests, and local dev installs L14: const isGlobal = process.env.npm[redacted] === "true"; L15: const isCI = process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true"; L16: ... L23: const agentDirs = [ L24: join(homedir(), ".claude"), L25: join(homedir(), ".config", "devin"),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = tdai-memory-mcp@0.5.16 matchedPath = scripts/postinstall.js matchedIdentity = npm:dGRhaS1tZW1vcnktbWNw:0.5.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.js

Findings

1 Critical9 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighShell

HighCredential Redirect Persistencedist/index.js

HighEntrypoint Foreign Package Code Overwritedist/index.js

HighCross File Remote Execution Contextscripts/postinstall.js

HighRuntime Package Installdist/index.js

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Similarityscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

Affected versions and remediation

This report applies to tdai-memory-mcp@0.5.17.

The versions list below shows the verdict for each recorded version.

Avoid installing tdai-memory-mcp@0.5.17. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-11 16:49:31.424Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

17 known versions

0.5.18latestClean—AllowPublishedAug 15, 2026, 7:42 AM 0.5.17shownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 11, 2026, 4:45 PM 0.5.16MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 11, 2026, 4:33 PM 0.5.15MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 11, 2026, 4:23 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code