binarytree retweetledi

Heads up: Removed claude-mem plugin from our Claude Code setup
After doing some research, I found several serious issues with the claude-mem plugin (by thedotmack) that we've been running:
1. Leaked processes & token drain
The worker daemon spawns Claude CLI subprocesses that never terminate. Users have reported 280+ orphaned processes consuming 65GB RAM, and one case of 61M+ input tokens burned in a single day ($183/day unintended spend). This has been reported across multiple GitHub issues over months (#650, #1089, #1090, #1168) and is still not fully resolved.
2. Security vulnerabilities
A security audit (Issue #1251) found that the plugin's HTTP API on port 37777 is fully unauthenticated — any local process can access all captured session data, which can include API keys, passwords, and proprietary code. Path traversal vulnerabilities were also identified.
3. CLAUDE.md file pollution
The plugin auto-generates CLAUDE.md files in arbitrary directories, even when there are zero observations. These directly conflict with manually curated CLAUDE.md project instructions and can get accidentally committed to repos.
4. Redundant with built-in features
Claude Code's native memory system (CLAUDE.md + project memory files) covers the same use cases without the overhead. Our manually structured approach is actually what experienced users converge on after removing plugins like this.
What I did: Uninstalled the plugin, removed its database (~7MB), and cleaned up all leftover files. No data loss — our actual project memory files (CLAUDE.md, MEMORY.md, etc.) are untouched.
Sources:
GitHub Issue #1090 — Leaked processes
GitHub Issue #1251 — Security audit
GitHub Issue #941 — CLAUDE.md pollution
English





















