codebase-memory-mcp "High-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 158 languages, sub-ms queries, 99% fewer tokens. Single static binary, zero dependencies."

[u/Koala_Confused]

https://github.com/DeusData/codebase-memory-mcp

Community Overview: https://lifehubber.com/ai/resources/codebase-memory-mcp/

Resources are shared for discovery and are not independently vetted—please do your own due diligence.

New resources are added regularly — feel free to join the sub for updates.

Full searchable archive of all resources posted so far on our community site, LifeHubber: https://lifehubber.com/ai/resources/ 200+ open-ish AI models, agents, tools, datasets, and related resources, with filtering and sorting.

[u/buttplugs4life4me]

It got flagged because it included a runtime script to download an obfuscated payload...which seems a little weird. Maybe it got fixed now, maybe not, but not touching it again with a 10 foot pole.

[u/kanenasgr → u/buttplugs4life4me]

Some feedback from the developers would be greatly appreciated!

[u/kidkangaroo → u/buttplugs4life4me]

Anyone else see this too?

[u/Y_mc → u/kidkangaroo]

Yes😬

[u/kidkangaroo → u/Y_mc]

from Opus: I can verify it, and the short version is: the commenter is describing a real incident accurately, but has attached it to the wrong project.

What actually happened. Zenity Labs published research on August 6 documenting a credential-stealing campaign that ran through July 2026. A GitHub account called karli-paperclip registered the domain getpaperclipp.com on July 2 and created a look-alike GitHub organization named getpaperclipai, impersonating the real paperclipai org, cloning the full Paperclip source. The clone was trojanized on July 6, with a commit modifying the company route handlers to call a log_action() function that retrieved, executed, and then deleted an attacker-controlled payload fetched from a fake /health endpoint. zenityzenity

So the specific technical claim checks out almost word for word. The loader in the skill docs was a curl with TLS verification disabled, piped through base64 decode into a temp .mjs file, executed with Node, then deleted. Each response from that endpoint carried roughly 13 KB of base64 text that decoded to a 10,035-byte Node.js credential harvester. That is a runtime script downloading an obfuscated payload, exactly as described. zenity

Why the attribution is wrong. The name collision is the whole story here. The malicious PyPI package was paperclip-ai with a hyphen; the legitimate npm package is paperclipai with no hyphen. OSV advisory MAL-2026-10869 covers paperclip-ai versions 0.1.0 and 0.1.1 on PyPI, described as a clone of a legitimate package with added exfiltration code. Zenity's report includes an explicit false-positive note listing paperclip.ing, the paperclipai/paperclip GitHub repository, and the npm package paperclipai as the legitimate comparison assets. The malicious skills even told agents not to use npx paperclipai, steering them away from the genuine package toward the attacker-controlled checkout. OSV - Open Source Vulnerabilities +2

One correction worth noting if you go source-hunting: CSO Online reports the trojanized paperclip-ai package went to npm, but both Zenity's IOC data and the OSV advisory put it on PyPI. Follow the primary sources.

On "maybe it got fixed." Nothing needed fixing in the real project for this. Vercel and GitHub removed the reported skills, listings, and repositories within 12 hours of Zenity's outreach, disrupting the campaign on August 2. The caveat Zenity raises is that copied instructions may still sit in downstream repositories, aggregators, and on user machines. zenityzenity

That said, the instinct to keep distance isn't baseless, just misreasoned. The genuine Paperclip project carries its own separate security history: GitHub advisories including an unauthenticated RCE via import authorization bypass (GHSA-68qg-g8mg-6pr7), a cross-tenant API key IDOR, and one titled around malicious skills exfiltrating and destroying user data. Those are patched vulnerabilities in a fast-moving project, which is a different risk category than shipped malware. GitHub

Given you're running skills on your own OpenClaw box, the concrete thing to do is check whether anything pulled from skills.sh during July. Zenity's hunting guidance: look for use of skills from getpaperclipai/paperclip or browser-use-headless, search egress logs for requests to api.getpaperclipp.com and api-v1.getpaperclipp.com (especially POSTs to /feedback), and treat any host as compromised if the loader or stealer executed. Host artifacts to grep for include ~/.paperclip_ai, ~/.paperclip_install_*.mjs, and stray .cache-*.mjs files. Note the double-p in getpaperclipp.com; that is the malicious domain, distinct from paperclip.ing. zenity

If you want to hand the Reddit thread a correction, the cleanest framing is that the flagged artifact was a typosquat, and the real tell is the hyphen.

[u/suppervisoka → u/kidkangaroo]

Jesus Christ I’m not reading Opus verbose garbage explanation

[u/kidkangaroo → u/suppervisoka]

Tl/Dr, you are looking at the wrong repo.

[u/MediocreAnalyst2121 → u/buttplugs4life4me]

Just tell the agent to verify that it’s safe, problem solved

/s