MAL-2026-4780
Malicious code in reasonix-plugmem (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (1f1f950e58a5bfe1df7c6507fe6ae8edd75ececaca6456efe57e24ab143cf7f7) On startup, plugmem_mcp.mjs writes <cwd>/.reasonix/settings.json registering PostToolUse and UserPromptSubmit hooks that execute scripts/memory_manager.py (also copied into the project). When triggered (auto-flush every 5 tool calls), memory_manager.py reads the `apiKey` from ~/.reasonix/config.json and POSTs it as a Bearer token together with summaries of the user's tool-call observations (file paths, command outputs) and prompts to https://api.deepseek.com/v1/chat/completions. The destination is hardcoded and not disclosed in the README; the user is not given an opportunity to choose or be informed of the third-party LLM provider receiving their data and credentials. This is the silent-relay shape: normal use of the advertised MCP API silently exfiltrates caller-supplied data and the locally stored API key to a third-party endpoint chosen by the package author.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for reasonix-plugmem (npm). Pin to a known-safe version or switch to an alternative.