registry  /  toon-memory  /  1.1.0

toon-memory@1.1.0

Persistent memory system for AI coding agents using TOON format (40% fewer tokens than JSON)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `toon-memory`, `toon-memory init`, installer scripts, or `toon-memory upgrade`.
Impact
Configured agents may launch this package through `npx`; setup can modify agent configuration files and install a missing dependency.
Mechanism
User-invoked AI-agent MCP configuration and local memory-file management.
Rationale
The malicious scanner label is not supported by source inspection: installation has no automatic lifecycle hook and the identified writes occur only through explicit CLI or installer actions. Warn because the package intentionally configures multiple AI-agent MCP control surfaces and may invoke npm installation at runtime.
Evidence
package.jsonbin/toon-memory.jsbin/setup.jssrc/mcp/server.tssrc/memory.tsmcp/server.jsinstall.shinstall.ps1uninstall.sh.opencode/memory/data.toon.opencode/tools/memory.ts.opencode/opencode.json.vscode/mcp.json.claude/settings.json.cursor/mcp.json.codeium/windsurf/mcp_config.json
Network endpoints1
registry.npmjs.org/toon-memory/-/toon-memory-${TOON_VERSION}.tgz

Decision evidence

public snapshot
AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `bin/setup.js` explicitly configures seven AI-agent MCP config locations.
  • `bin/setup.js` supports global home-directory configuration writes after CLI invocation.
  • `bin/setup.js` runs `npm install @toon-format/toon` if resolution fails.
  • `bin/setup.js` upgrade command queries npm then globally installs the returned version.
  • `install.sh` and `install.ps1` download/install package artifacts and alter user PATH when explicitly run.
Evidence against
  • `package.json` has only `prepublishOnly`; no preinstall/install/postinstall hook.
  • `bin/toon-memory.js` dispatches setup only after the user runs the CLI.
  • Agent-config changes add a visible `toon-memory` MCP entry invoking `npx -y toon-memory mcp`.
  • `src/mcp/server.ts` reads and writes only project `.opencode/memory/data.toon`.
  • No source evidence of credential harvesting, secret/environment exfiltration, or outbound runtime HTTP requests.
  • `mcp/server.js` dynamic Function is bundled AJV validation code, not package-controlled payload execution.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 5 file(s), 1.06 MB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

6 flagged · loading source
bin/toon-memory.jsView file
3import { fileURLToPath } from "url" L4: import { spawn } from "child_process" L5:
High
Child Process

Package source references child process execution.

bin/toon-memory.jsView on unpkg · L3
3Cross-file remote execution chain: bin/toon-memory.js spawns mcp/server.js; helper contains network access plus dynamic code execution. L3: import { fileURLToPath } from "url" L4: import { spawn } from "child_process" L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)) L7: const args = process.argv.slice(2)
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/toon-memory.jsView on unpkg · L3
mcp/server.jsView file
17095if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L17096: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L17097: this.scope.value(validateName, { ref: validate });
Low
Eval

Package source references a known benign dynamic code generation pattern.

mcp/server.jsView on unpkg · L17095
bin/setup.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = toon-memory@1.0.9 matchedIdentity = npm:dG9vbi1tZW1vcnk:1.0.9 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/setup.jsView on unpkg
18console.log("Installing @toon-format/toon...") L19: execSync("npm install @toon-format/toon", { cwd: projectRoot, stdio: "inherit" }) L20: }
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/setup.jsView on unpkg · L18
uninstall.shView file
•path = uninstall.sh kind = build_helper sizeBytes = 3247 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

Findings

1 Critical4 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltabin/setup.js
HighChild Processbin/toon-memory.js
HighShell
HighCross File Remote Execution Contextbin/toon-memory.js
HighRuntime Package Installbin/setup.js
MediumEnvironment Vars
MediumShips Build Helperuninstall.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalmcp/server.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings