registry  /  toon-memory  /  1.5.0

toon-memory@1.5.0

Persistent memory system for AI coding agents using TOON format (40% fewer tokens than JSON)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `toon-memory`, `toon-memory init`, or selects an installer scope.
Impact
Persists a package-owned MCP command in selected global or project AI-agent settings; no credential collection, remote payload execution, or destructive behavior was found.
Mechanism
Explicit CLI-driven AI-agent MCP configuration and local memory-tool setup.
Rationale
This is an explicit-user-command, first-party AI-agent configuration capability rather than concrete malware. Its broad multi-agent persistence and runtime npm installation behavior warrant a warning, not a block.
Evidence
package.jsonsrc/bin/toon-memory.tssrc/cli/setup.tssrc/mcp/server.tsinstall.shinstall.ps1uninstall.sh.opencode/opencode.json.vscode/mcp.json.claude/settings.json.cursor/mcp.json.codeium/windsurf/mcp_config.json.cline/mcp.json.continue/config.json.opencode/tools/memory.ts.opencode/memory/data.toon.gitignore
Network endpoints1
registry.npmjs.org/toon-memory/-/toon-memory-${TOON_VERSION}.tgz

Decision evidence

public snapshot
AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `src/cli/setup.ts` writes MCP entries for OpenCode, VS Code, Claude, Cursor, Windsurf, Cline, and Continue.
  • The default CLI path prompts then configures every supported agent; `init` does the same without prompts.
  • `src/cli/setup.ts` invokes npm to install a missing dependency and its explicit `upgrade` command installs the latest package globally.
Evidence against
  • `package.json` has only `prepublishOnly`; consumers receive no install lifecycle hook.
  • Config mutation occurs only after an explicit CLI invocation, not package install or import.
  • `src/mcp/server.ts` uses stdio and local project `.opencode/memory` files; no application network or exfiltration code found.
  • `src/bin/toon-memory.ts` only dispatches to the local CLI or MCP server.
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 9 file(s), 1.09 MB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

7 flagged · loading source
bin/toon-memory.jsView file
3import { fileURLToPath } from "url"; L4: import { spawn } from "child_process"; L5: const __dirname = dirname(fileURLToPath(import.meta.url));
High
Child Process

Package source references child process execution.

bin/toon-memory.jsView on unpkg · L3
3Cross-file remote execution chain: bin/toon-memory.js spawns mcp/server.js; helper contains network access plus dynamic code execution. L3: import { fileURLToPath } from "url"; L4: import { spawn } from "child_process"; L5: const __dirname = dirname(fileURLToPath(import.meta.url)); L6: const args = process.argv.slice(2);
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/toon-memory.jsView on unpkg · L3
mcp/server.jsView file
17095if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L17096: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L17097: this.scope.value(validateName, { ref: validate });
Low
Eval

Package source references a known benign dynamic code generation pattern.

mcp/server.jsView on unpkg · L17095
dist/cli/setup.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = toon-memory@1.1.0 matchedIdentity = npm:dG9vbi1tZW1vcnk:1.1.0 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/setup.jsView on unpkg
14console.log("Installing @toon-format/toon..."); L15: execSync("npm install @toon-format/toon", { cwd: projectRoot, stdio: "inherit" }); L16: }
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/setup.jsView on unpkg · L14
11try { L12: createRequire(import.meta.url).resolve("@toon-format/toon"); L13: } catch {
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/setup.jsView on unpkg · L11
uninstall.shView file
•path = uninstall.sh kind = build_helper sizeBytes = 3247 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

Findings

1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli/setup.js
HighChild Processbin/toon-memory.js
HighShell
HighCross File Remote Execution Contextbin/toon-memory.js
HighRuntime Package Installdist/cli/setup.js
MediumDynamic Requiredist/cli/setup.js
MediumEnvironment Vars
MediumShips Build Helperuninstall.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalmcp/server.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings