Loading npm security reports…

tdai-memory-mcp@0.5.15: AI-agent control-surface risk | LPM Firewall

registry / tdai-memory-mcp / 0.5.15

tdai-memory-mcp@0.5.15

Long-term memory for AI coding agents. Memory + CodeGraph + Wiki in one SQLite file. Auto-recall, auto-capture, no API key, no cloud.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall silently mutates detected third-party AI-agent configurations. It registers this package as an MCP server and installs commands that run during agent lifecycle events.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install -g tdai-memory-mcp on a machine with supported agent config directories

Impact

Unconsented execution of package commands in Claude, Devin, Codex, or Cursor agent workflows.

Mechanism

postinstall-triggered cross-agent config and hook persistence

Policy narrative

On global installation, the postinstall script detects AI-agent directories and silently invokes `setup`. Setup writes MCP server registrations and lifecycle hooks into foreign agent configurations. Those hooks invoke this package through the installed binary or `npx` on future agent session events, creating unconsented persistence across multiple agent control surfaces.

Rationale

Direct inspection confirms a concrete postinstall-driven mutation of broad foreign AI-agent control surfaces. This meets the blocking policy regardless of the otherwise package-aligned optional OpenAI API use.

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.claude.json~/.claude/settings.json~/.config/devin/mcp_config.json~/.config/devin/config.json~/.cursor/mcp.json~/.codex/config.toml

Network endpoints

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tdai-memory-mcp@0.5.11 matchedIdentity = npm:dGRhaS1tZW1vcnktbWNw:0.5.11 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

676// src/doctor.ts L677: import { execFileSync } from "child_process"; L678: import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L676

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: baseUrl; this.baseUrl = opts.baseUrl ?? "https://api.openai.com/v1"; const url = `${this.baseUrl}/chat/completions`; Authorization: `Bearer ${this.apiKey}` const baseUrl = process.env.TDAI_LLM_BASE_URL ?? "https://api.openai.com/v1"; const llmClient = new OpenAILLMClient({ apiKey, baseUrl, model }); const baseUrl = env.TDAI_LLM_BASE_URL ?? file?.llm?.baseUrl; baseUrl: baseUrl ?? "https://api.openai.com/v1",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs"; copyFileSync(dbPath, dbBackup); copyFileSync(walPath, join2(backupDir, `${basename(dbPath)}-wal`)); copyFileSync(shmPath, join2(backupDir, `${basename(dbPath)}-shm`)); copyFileSync(auditPath, auditBackup); return `Extract 1-3 atomic facts from the following ${type}. Each fact must be: this.baseUrl = opts.baseUrl ?? "https://api.openai.com/v1"; const baseUrl = process.env.TDAI_LLM_BASE_URL ?? "https://api.openai.com/v1";

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

733try { L734: binPath = execFileSync("which", ["tdai-memory-mcp"], { encoding: "utf-8" }).trim(); L735: checks.push({ ok: true, detail: `Binary: ${binPath}` }); L736: } catch { L737: checks.push({ ok: false, detail: "Binary: not in PATH (npx will be used)" }); L738: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L733

scripts/postinstall.jsView file

6Cross-file remote execution chain: scripts/postinstall.js spawns dist/index.js; helper contains network access plus dynamic code execution. L6: */ L7: import { spawn } from "node:child_process"; L8: import { existsSync } from "node:fs"; ... L11: L12: // Only auto-setup on global install (npm[redacted] === "true") L13: // Skip in CI, tests, and local dev installs L14: const isGlobal = process.env.npm[redacted] === "true"; L15: const isCI = process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true"; L16: ... L23: const agentDirs = [ L24: join(homedir(), ".claude"), L25: join(homedir(), ".config", "devin"),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L6

Source & flagged code

8 flagged

package.jsonView file

Lines 41-81json

41 ".": {

42 "import": "./dist/sdk.js"

43 }

44 },

45 "files": [

46 "dist",

47 "skills",

48 "scripts"

49 ],

50 "engines": {

51 "node": ">=22"

52 },

53 "scripts": {

54 "build": "tsup && mkdir -p dist/storage && cp src/storage/schema.sql dist/storage/schema.sql",

55 "dev": "tsup --watch",

56 "test": "vitest run",

57 "test:watch": "vitest",

58 "lint": "biome check src",

59 "format": "biome format --write src",

60 "start": "node dist/index.js",

61 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "prepublishOnly": "npm run build"

63 },

64 "dependencies": {

65 "@huggingface/transformers": "^4.2.0",

66 "@kreuzberg/tree-sitter-language-pack": "^1.10.9",

67 "@modelcontextprotocol/sdk": "^1.30.0",

68 "better-sqlite3": "^13.0.3",

69 "gpt-tokenizer": "^3.4.0",

70 "sqlite-vec": "^0.1.9",

71 "tree-sitter": "^0.25.1",

72 "ulid": "^3.0.2"

73 },

74 "devDependencies": {

75 "@biomejs/biome": "^2.5.7",

76 "@types/better-sqlite3": "^7.6.13",

77 "@types/node": "^22.0.0",

78 "tsup": "^8.5.1",

79 "typescript": "^5.5.0",

80 "vitest": "^4.1.10"

81 }

dist/index.jsView file

Lines 656-696javascript

656 env.TDAI_REDACT_SECRETS,

657 fileSecurity.redactSecrets ?? true

658 ),

659 maxTokensRecall: parseEnvInt(

660 env.TDAI_MAX_TOKENS_RECALL,

661 fileSecurity.maxTokensRecall ?? 4e3

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Postinstall script — runs automatically after `npm install -g tdai-memory-mcp`.

4 * Auto-registers MCP server + hooks in detected agent configs.

5 * Silent on failure (don't block npm install). Only runs on global install.

6 */

7import { spawn } from "node:child_process";

8import { existsSync } from