@iamem/amem@0.7.0

Analysis

This package installs a local SQLite-backed "agent memory" service for AI coding assistants and, on npm install, runs scripts/postinstall.js, which sends an anonymous install beacon containing the package name and version, the Node.js version, the OS platform and CPU architecture, and a timestamp, POSTed to hxxps://getamem[.]com/api/beacon/npm-install. The beacon is suppressed when AMEM_TELEMETRY_DISABLED is set or in CI, and it never blocks the install. Beyond that install-time request, the package writes MCP server entries for Claude, Cursor, Windsurf and Continue into those clients' configuration files (pointing them at the package's own hxxp://127[.]0[.]0[.]1:7843/mcp URL), and registers recurring background jobs for its memory-hygiene and backup tasks by writing a macOS LaunchAgent plist and a systemd user timer and loading them with launchctl / systemctl. When launched from the npx cache it also runs `npm install -g @iamem/amem@<version>` to keep a stable global CLI. The package ships no obfuscated code, no dynamic code evaluation, and no credential, token, environment-value or wallet-key collection; the only outbound destination in the code is getamem[.]com and the only local service endpoint is 127[.]0[.]0[.]1:7843.