@awareness.market/local@0.22.0
Local-first memory for AI agents. Structured synthetic memory cards (decision / preference / risk), verifiable state history via ERC-8350, hybrid search. Runs offline, no account.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe daemon sends default-on runtime telemetry to the vendor's service, and the package README does not disclose it. The fields are narrowly allowlisted and no sensitive content or credentials were found, so this warrants a warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting the daemon; queued events are flushed periodically or when the batch threshold is reached.
Impact
The vendor can associate reported usage events with a persistent pseudonymous installation identifier. No credential or content exfiltration was identified.
Mechanism
The daemon records allowlisted usage and runtime fields with a hashed installation ID, then posts event batches to the telemetry endpoint.
AI rationale
The daemon sends default-on runtime telemetry to the vendor's service, and the package README does not disclose it. The fields are narrowly allowlisted and no sensitive content or credentials were found, so this warrants a warning rather than a malicious verdict.
Evidence
src/core/telemetry.mjssrc/daemon.mjs.awareness/telemetry-queue.json
Network endpoints1
awareness.market/api/v1/telemetry/events
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Telemetry is initialized when the daemon starts and is enabled unless configuration explicitly sets telemetry.enabled to false.
- Telemetry events include a persistent hashed installation ID and are sent in batches to the configured endpoint, which defaults to awareness.market.
- Daemon-start events contain version, platform, runtime, locale, success, and a fixed error code; telemetry properties are restricted to an allowlist.
- The manifest's postinstall runs a helper that checks for the declared transformers dependency and installs it if missing.
Evidence against
- The package describes itself as local-first memory software that runs offline and requires no account.
- The reviewed telemetry fields do not include credentials, file contents, prompts, code, or command output.
- The publish flow sends the configured Awareness API key only when the user invokes the publish-agent MCP tool.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node install-transformers.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/awareness-local.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @awareness.market/local@0.21.1
matchedIdentity = npm:QGF3YXJlbmVzcy5tYXJrZXQvbG9jYWw:0.21.1
similarity = 0.950
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/awareness-local.mjsView on unpkg16L17: import { spawn } from 'node:child_process';
L18: import fs from 'node:fs';
High
Findings
1 Critical8 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltabin/awareness-local.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/awareness-local.mjs
HighShell
HighSame File Env Network Executionbin/awareness-local.mjs#virtual:normalized:round1
HighCommand Output Exfiltrationbin/awareness-local.mjs#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitysrc/daemon/api-handlers.mjs
HighTrigger Reachable Command Output Exfiltrationbin/awareness-local.mjs#virtual:normalized:round1
HighSemantic Analysis Limitedbin/awareness-local.mjs#virtual:normalized:round1
MediumDynamic Requirebin/cli.cjs
MediumNetwork
Affected versions and remediation
This report applies to @awareness.market/local@0.22.0.
See all versions of @awareness.market/local for other recorded verdicts.
- Review the evidence and your use of @awareness.market/local@0.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.