Loading npm security reports…

tdai-memory-mcp@0.5.16: AI-agent control-surface risk | LPM Firewall

registry / tdai-memory-mcp / 0.5.16

tdai-memory-mcp@0.5.16

Long-term memory for AI coding agents. Memory + CodeGraph + Wiki in one SQLite file. Auto-recall, auto-capture, no API key, no cloud.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global npm installation automatically changes detected third-party AI-agent configurations. It registers this MCP server and lifecycle command hooks that capture and inject agent-session context.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm global install outside CI on a host with a supported agent directory

Impact

Persistent execution of package commands in Claude Code, Devin, Cursor, or Codex agent lifecycles; command/session content is captured locally.

Mechanism

postinstall-launched foreign AI-agent config and hook mutation

Policy narrative

The install-time script detects existing AI-agent installations and silently launches `setup` during global npm installation. Setup writes MCP server registrations and command hooks into foreign Claude, Devin, Cursor, and Codex configuration files. Those hooks execute this package at agent lifecycle events and capture command failures and session data into its database, creating unconsented persistence across agent sessions.

Rationale

This is a concrete postinstall mutation of broad third-party AI-agent control surfaces, which meets the blocking policy. The optional OpenAI-compatible extraction path does not mitigate the unconsented lifecycle takeover.

Evidence

package.jsonscripts/postinstall.jsdist/index.jsskills/tdai-memory/SKILL.md~/.claude.json~/.claude/settings.json~/.config/devin/mcp_config.json

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tdai-memory-mcp@0.5.11 matchedIdentity = npm:dGRhaS1tZW1vcnktbWNw:0.5.11 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

676// src/doctor.ts L677: import { execFileSync } from "child_process"; L678: import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L676

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: baseUrl; this.baseUrl = opts.baseUrl ?? "https://api.openai.com/v1"; const url = `${this.baseUrl}/chat/completions`; Authorization: `Bearer ${this.apiKey}` const baseUrl = process.env.TDAI_LLM_BASE_URL ?? "https://api.openai.com/v1"; const llmClient = new OpenAILLMClient({ apiKey, baseUrl, model }); const baseUrl = env.TDAI_LLM_BASE_URL ?? file?.llm?.baseUrl; baseUrl: baseUrl ?? "https://api.openai.com/v1",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs"; copyFileSync(dbPath, dbBackup); copyFileSync(walPath, join2(backupDir, `${basename(dbPath)}-wal`)); copyFileSync(shmPath, join2(backupDir, `${basename(dbPath)}-shm`)); copyFileSync(auditPath, auditBackup); return `Extract 1-3 atomic facts from the following ${type}. Each fact must be: this.baseUrl = opts.baseUrl ?? "https://api.openai.com/v1"; const baseUrl = process.env.TDAI_LLM_BASE_URL ?? "https://api.openai.com/v1";

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

733try { L734: binPath = execFileSync("which", ["tdai-memory-mcp"], { encoding: "utf-8" }).trim(); L735: checks.push({ ok: true, detail: `Binary: ${binPath}` }); L736: } catch { L737: checks.push({ ok: false, detail: "Binary: not in PATH (npx will be used)" }); L738: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L733

•matchType = normalized_sha256 matchedPackage = tdai-memory-mcp@0.5.15 matchedPath = dist/index.js matchedIdentity = npm:dGRhaS1tZW1vcnktbWNw:0.5.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0f25206fc450a929 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = tdai-memory-mcp@0.5.15 matchedPath = dist/index.js matchedIdentity = npm:dGRhaS1tZW1vcnktbWNw:0.5.15 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

scripts/postinstall.jsView file

6Cross-file remote execution chain: scripts/postinstall.js spawns dist/index.js; helper contains network access plus dynamic code execution. L6: */ L7: import { spawn } from "node:child_process"; L8: import { existsSync } from "node:fs"; ... L11: L12: // Only auto-setup on global install (npm[redacted] === "true") L13: // Skip in CI, tests, and local dev installs L14: const isGlobal = process.env.npm[redacted] === "true"; L15: const isCI = process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true"; L16: ... L23: const agentDirs = [ L24: join(homedir(), ".claude"), L25: join(homedir(), ".config", "devin"),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = tdai-memory-mcp@0.5.15 matchedPath = scripts/postinstall.js matchedIdentity = npm:dGRhaS1tZW1vcnktbWNw:0.5.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 41-81json

41 ".": {

42 "import": "./dist/sdk.js"

43 }

44 },

45 "files": [

46 "dist",

47 "skills",

48 "scripts"

49 ],

50 "engines": {

51 "node": ">=22"

52 },

53 "scripts": {

54 "build": "tsup && mkdir -p dist/storage && cp src/storage/schema.sql dist/storage/schema.sql",

55 "dev": "tsup --watch",

56 "test": "vitest run",

57 "test:watch": "vitest",

58 "lint": "biome check src",

59 "format": "biome format --write src",

60 "start": "node dist/index.js",

61 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "prepublishOnly": "npm run build"

63 },

64 "dependencies": {

65 "@huggingface/transformers": "^4.2.0",

66 "@kreuzberg/tree-sitter-language-pack": "^1.10.9",

67 "@modelcontextprotocol/sdk": "^1.30.0",

68 "better-sqlite3": "^13.0.3",

69 "gpt-tokenizer": "^3.4.0",

70 "sqlite-vec": "^0.1.9",

71 "tree-sitter": "^0.25.1",

72 "ulid": "^3.0.2"

73 },

74 "devDependencies": {

75 "@biomejs/biome": "^2.5.7",

76 "@types/better-sqlite3": "^7.6.13",

77 "@types/node": "^22.0.0",

78 "tsup": "^8.5.1",

79 "typescript": "^5.5.0",

80 "vitest": "^4.1.10"

81 }

dist/index.jsView file

Lines 656-696javascript

656 env.TDAI_REDACT_SECRETS,

657 fileSecurity.redactSecrets ?? true

658 ),

659 maxTokensRecall: parseEnvInt(

660 env.TDAI_MAX_TOKENS_RECALL,

661 fileSecurity.maxTokensRecall ?? 4e3

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Postinstall script — runs automatically after `npm install -g tdai-memory-mcp`.

4 * Auto-registers MCP server + hooks in detected agent configs.

5 * Silent on failure (don't block npm install). Only runs on global install.

6 */

7import { spawn } from "node:child_process";

8import { existsSync } from