Malicious code in @lizhao1/memorax-code-internal (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b983c7d55b41a0eb0cd384b7efbdf186926e3e6ce1f88c62c8cf59a96e648285) The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionConfig() with no user prompt, writing internal.data_collection.enabled=true and a self-defined consent string into ~/.memorax-code/config.toml, then starts a backend that harvests and transmits Codex and Claude Code session content. The backend module lib/memorax-code-backend/dist/internal-trace-collection-config.js hardcodes the destination http://47.112.192.211:8789/memorax-code/trace-collection (bare IP, plain HTTP, Alibaba Cloud netblock — not matching the advertised publisher domain code.memorax.net). flushInternalTraceCollection reads per-session events.jsonl and native rollout files for the configured AI clients and POSTs them in batches to that endpoint. Only a narrow allow-list of key names (authorization/api_key/secret/password) is redacted; user prompts, assistant replies, tool arguments, and file contents embedded in session events are transmitted in full. The 'consent' gate is satisfied by the postinstall itself writing the accepted consent-version string, and the pipeline is labeled 'internal data collection' / 'anonymous' despite shipping full session bodies to a hardcoded third-party endpoint.
AI Analysis
Technical Summary
The npm package @lizhao1/memorax-code-internal (versions 0.1.0 and 0.1.1) includes a postinstall script that automatically calls enableInternalDataCollectionConfig(), writing a consent string and enabling data collection in ~/.memorax-code/config.toml without user interaction. It then launches a backend module that collects Codex and Claude Code session data, including user inputs and assistant outputs, and sends this data in batches via HTTP POST to a hardcoded IP address (http://47.112.192.211:8789/memorax-code/trace-collection) hosted on Alibaba Cloud. Only a narrow allow-list of sensitive keys is redacted; the rest of the session content is transmitted in clear text. The consent mechanism is effectively bypassed by the postinstall script itself, and the data collection is misleadingly labeled as 'internal' and 'anonymous' despite sending full session bodies to an external third party.
Potential Impact
This malicious behavior results in unauthorized exfiltration of potentially sensitive user session data, including prompts, replies, tool arguments, and file contents, to an external third-party server without explicit user consent. This compromises user privacy and may expose confidential or proprietary information. The use of plain HTTP and a hardcoded IP address increases the risk of interception and misuse of the data. The package undermines trust in the software supply chain by embedding covert data harvesting functionality.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or using versions 0.1.0 and 0.1.1 of @lizhao1/memorax-code-internal. Remove these versions if already installed and monitor for updates or advisories from the package maintainers or npm security teams. Since the package is not a cloud service, remediation depends on user action. Check the vendor or npm advisories for any future fixes or removal notices.
Malicious code in @lizhao1/memorax-code-internal (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b983c7d55b41a0eb0cd384b7efbdf186926e3e6ce1f88c62c8cf59a96e648285) The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionConfig() with no user prompt, writing internal.data_collection.enabled=true and a self-defined consent string into ~/.memorax-code/config.toml, then starts a backend that harvests and transmits Codex and Claude Code session content. The backend module lib/memorax-code-backend/dist/internal-trace-collection-config.js hardcodes the destination http://47.112.192.211:8789/memorax-code/trace-collection (bare IP, plain HTTP, Alibaba Cloud netblock — not matching the advertised publisher domain code.memorax.net). flushInternalTraceCollection reads per-session events.jsonl and native rollout files for the configured AI clients and POSTs them in batches to that endpoint. Only a narrow allow-list of key names (authorization/api_key/secret/password) is redacted; user prompts, assistant replies, tool arguments, and file contents embedded in session events are transmitted in full. The 'consent' gate is satisfied by the postinstall itself writing the accepted consent-version string, and the pipeline is labeled 'internal data collection' / 'anonymous' despite shipping full session bodies to a hardcoded third-party endpoint.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The npm package @lizhao1/memorax-code-internal (versions 0.1.0 and 0.1.1) includes a postinstall script that automatically calls enableInternalDataCollectionConfig(), writing a consent string and enabling data collection in ~/.memorax-code/config.toml without user interaction. It then launches a backend module that collects Codex and Claude Code session data, including user inputs and assistant outputs, and sends this data in batches via HTTP POST to a hardcoded IP address (http://47.112.192.211:8789/memorax-code/trace-collection) hosted on Alibaba Cloud. Only a narrow allow-list of sensitive keys is redacted; the rest of the session content is transmitted in clear text. The consent mechanism is effectively bypassed by the postinstall script itself, and the data collection is misleadingly labeled as 'internal' and 'anonymous' despite sending full session bodies to an external third party.
Potential Impact
This malicious behavior results in unauthorized exfiltration of potentially sensitive user session data, including prompts, replies, tool arguments, and file contents, to an external third-party server without explicit user consent. This compromises user privacy and may expose confidential or proprietary information. The use of plain HTTP and a hardcoded IP address increases the risk of interception and misuse of the data. The package undermines trust in the software supply chain by embedding covert data harvesting functionality.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or using versions 0.1.0 and 0.1.1 of @lizhao1/memorax-code-internal. Remove these versions if already installed and monitor for updates or advisories from the package maintainers or npm security teams. Since the package is not a cloud service, remediation depends on user action. Check the vendor or npm advisories for any future fixes or removal notices.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12320
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735742bf8831d539159083
Added to database: 08/05/2026, 15:31:14 UTC
Last enriched: 08/05/2026, 17:08:18 UTC
Last updated: 09/15/2026, 11:22:08 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.