registry / @awareness.market/local / 0.11.8
@awareness.market/local@0.11.8
Local-first AI agent memory system. No account needed.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node install-transformers.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/awareness-local.mjsView file
16L17: import { spawn } from 'node:child_process';
L18: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
bin/awareness-local.mjsView on unpkg · L16785L786: const { execSync } = await import('child_process');
L787:
...
L791: const fs = await import('fs');
L792: let cmd = 'npm install @huggingface/transformers@^3.0.0';
L793:
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/awareness-local.mjsFindings
5 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/awareness-local.mjs
HighShell
HighSandbox Evasion Gated Capabilitysrc/daemon/api-handlers.mjs
HighRuntime Package Installbin/awareness-local.mjs
MediumDynamic Requirebin/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @awareness.market/local@0.11.8.
See all versions of @awareness.market/local for other recorded verdicts.
- Review the evidence and your use of @awareness.market/local@0.11.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.