registry / toon-memory / 1.0.9

toon-memory@1.0.9

Persistent memory system for AI coding agents using TOON format (40% fewer tokens than JSON)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `npx toon-memory` and accepts the interactive setup; separately, user manually runs `install.sh`.

Impact

Can alter agent MCP startup behavior and execute the configured package; no unconsented npm install-time execution is present.

Mechanism

Explicit CLI AI-agent configuration mutation and runtime package-manager execution.

Rationale

Source inspection confirms a user-invoked multi-agent configuration installer with runtime package-manager execution, but no install-time hook, credential harvesting, exfiltration, or hidden payload. Warn for explicit AI-agent control-surface mutation and the unpinned `npx -y` launch behavior.

Evidence

package.jsonbin/toon-memory.jsbin/setup.jssrc/mcp/server.tsmcp/server.jsinstall.shuninstall.shsrc/memory.ts$HOME/.config/opencode/opencode.json$HOME/.claude/settings.json$HOME/.codeium/windsurf/mcp_config.json.opencode/opencode.json.opencode/tools/memory.ts.opencode/memory/data.toon.vscode/mcp.json.claude/settings.json

Network endpoints1

registry.npmjs.org/toon-memory/-/toon-memory-${TOON_VERSION}.tgz

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`bin/setup.js` runs on explicit CLI invocation and edits multiple AI-agent configs.
It writes `npx -y toon-memory mcp` into global/local MCP settings.
`bin/setup.js` runs `npm install @toon-format/toon` if resolution fails.
`install.sh` can download a tarball and persist a PATH entry when manually piped to shell.

Evidence against

`package.json` has no preinstall, install, or postinstall hook.
CLI setup is interactive and requires the user to run `toon-memory`.
`src/mcp/server.ts` only reads/writes project `.opencode/memory/data.toon`.
No source network/exfiltration call exists in the MCP server or CLI setup.
Bundled `mcp/server.js` corresponds to the local memory server source.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 1.05 MB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

6 flagged

bin/toon-memory.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

2import { dirname, join } from "path"

3import { fileURLToPath } from "url"

4import { spawn } from "child_process"

High

Child Process

Package source references child process execution.

bin/toon-memory.jsView on unpkg · L3

6const __dirname = dirname(fileURLToPath(import.meta.url))

7const args = process.argv.slice(2)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/toon-memory.jsView on unpkg · L3

9const target = args[0] === "mcp"

10 ? join(__dirname, "..", "mcp", "server.js")

11 : join(__dirname, "setup.js")

13const extraArgs = args[0] === "mcp" ? [] : args

14const child = spawn("node", [target, ...extraArgs], { stdio: "inherit" })

15child.on("exit", (code) => process.exit(code ?? 0))

mcp/server.jsView file

17095if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L17096: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L17097: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

mcp/server.jsView on unpkg · L17095

bin/setup.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, readFileSync, writeFileSync, cpSync, unlinkSync, rmdirSync } from "fs"

3import { dirname, join } from "path"

4import { fileURLToPath } from "url"

5import { execSync } from "child_process"

6import { createInterface } from "readline"

7import

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 3247 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

Source & flagged code

6 flagged · loading source

bin/toon-memory.jsView file

3import { fileURLToPath } from "url" L4: import { spawn } from "child_process" L5:

High

Child Process

Package source references child process execution.

bin/toon-memory.jsView on unpkg · L3

3Cross-file remote execution chain: bin/toon-memory.js spawns mcp/server.js; helper contains network access plus dynamic code execution. L3: import { fileURLToPath } from "url" L4: import { spawn } from "child_process" L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)) L7: const args = process.argv.slice(2)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/toon-memory.jsView on unpkg · L3

mcp/server.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

mcp/server.jsView on unpkg · L17095

bin/setup.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = toon-memory@1.0.8 matchedIdentity = npm:dG9vbi1tZW1vcnk:1.0.8 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/setup.jsView on unpkg

18console.log("Installing @toon-format/toon...") L19: execSync("npm install @toon-format/toon", { cwd: projectRoot, stdio: "inherit" }) L20: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/setup.jsView on unpkg · L18

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 3247 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

Findings

1 Critical4 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltabin/setup.js

HighChild Processbin/toon-memory.js

HighShell

HighCross File Remote Execution Contextbin/toon-memory.js

HighRuntime Package Installbin/setup.js

MediumEnvironment Vars

MediumShips Build Helperuninstall.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalmcp/server.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

bin/toon-memory.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

2import { dirname, join } from "path"

3import { fileURLToPath } from "url"

4import { spawn } from "child_process"

High

Child Process

Package source references child process execution.

bin/toon-memory.jsView on unpkg · L3

6const __dirname = dirname(fileURLToPath(import.meta.url))

7const args = process.argv.slice(2)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/toon-memory.jsView on unpkg · L3

9const target = args[0] === "mcp"

10 ? join(__dirname, "..", "mcp", "server.js")

11 : join(__dirname, "setup.js")

13const extraArgs = args[0] === "mcp" ? [] : args

14const child = spawn("node", [target, ...extraArgs], { stdio: "inherit" })

15child.on("exit", (code) => process.exit(code ?? 0))

mcp/server.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

mcp/server.jsView on unpkg · L17095

bin/setup.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, readFileSync, writeFileSync, cpSync, unlinkSync, rmdirSync } from "fs"

3import { dirname, join } from "path"

4import { fileURLToPath } from "url"

5import { execSync } from "child_process"

6import { createInterface } from "readline"

7import

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 3247 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg