registry / @chude/memory / 4.0.3

@chude/memory@4.0.3

Cross-project context persistence for Claude Code sessions

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 983 KB of source, external domains: api.anthropic.com, api.openai.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-21javascript

1// @bun

2var y8=Object.create;var{getPrototypeOf:w8,defineProperty:E1,getOwnPropertyNames:h8}=Object;var v8=Object.prototype.hasOwnProperty;var S$=(A,_,$)=>{$=A!=null?y8(w8(A)):{};let G=_||!A||!A.__esModule?E1($,"default",{value:A,enumerable:!0}):$;for(let K of h8(A))if(!v8.call(G,K))E1(G,K,{get:()=>A[K],enumerable:!0});return G};var w=(A,_)=>{for(var $ in _)E1(A,$,{get:_[$],enumerable:!0,configurable:!0,set:(G)=>_[$]=()=>G})};var M=(A,_)=>()=>(A&&(_=A(A=0)),_);var n_=import.meta.require;class QA{_id;_type;_name;_confidence;_metadata;_createdAt;constructor(A){this._id=A.id,this._type=A.type,this._name= ...

3`);return $.length>0?$:null}return null}}class $_{static decodeProjectDirectory(A){return $A.fromEncoded(A)}static isEncodedPath(A){if(!A||A.length===0)return!1;if(I3.test(A))return!0;if(O3.test(A))return!0;return!1}static extractProjectName(A){return $A.fromEncoded(A).projectName}static filterEncodedPaths(A){return A.filter((_)=>$_.isEncodedPath(_))}static translatePath(A,_=process.platform){if(!A||A.trim()==="")return A;if(_==="win32"){let $=A.match(/^\/mnt\/([a-zA-Z])([\/]?)(.*)$/);if($){let G=$[1].toUpperCase(),K=$[3].replace(/\//g,"\\");return`${G}:\\${K}`}return A}else{let $=A.match(/^([ ...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

51. TOPICS: Key technical concepts discussed (1-5)

6 - Include only significant technical concepts, patterns, or technologies

7 - Each topic needs a name and confidence score (0-1)

92. TERMS: Domain-specific terminology defined or explained (0-3)

10 - Include only terms that were explicitly defined or explained

11 - Each term needs a name, definition, and confidence score (0-1)

133. DECISIONS: Explicit choices made with rationale (0-3)

14 - Include only decisions where a choice was made between alternatives

15 - Each decision needs: subject, decision, rejected alternatives, rationale, confidence

174. SUMMARY: 1-2 sentence summary of what was accomplished

19Output as JSON:

20{

21 "topics": [{ "name": "...", "confidence": 0.9 }],

Long lines were clipped for display.

Lines 1026-1073javascript

1026 AND s.start_time >= ?`:`JOIN sessions s ON l.source_type = 'session' AND l.source_id = s.id

1027 WHERE s.project_path_encoded = ?

1028 AND l.target_type = 'topic'`}

1029 ORDER BY l.weight DESC

1030 LIMIT ?

1031 `

Source & flagged code

5 flagged · loading source

dist/index.jsView file

1053`)].join(` L1054: `)}function W_(A){let _=A.trim(),$=_.match(/\[\s*\{[\s\S]*\}\s*\]/),G=$?$[0]:_;try{let K=JSON.parse(G);if(!Array.isArray(K))return[];let Z=[];for(let Y of K){if(typeof Y.content!==... L1055:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1053

1046ORDER BY COUNT(*) DESC L1047: LIMIT 1`).get(A)?.project_name??null}}var UK=M(()=>{BK();MK()});var UA,K0;var U5=M(()=>{UA={local:{model:"Xenova/all-MiniLM-L6-v2",dimensions:384},openai:{model:"text-embedding-3-s... L1048: `)}var EG,I5,O5,t,F5,FK,Z0,Z$;var HA=M(()=>{f();U5();EG={defaultMode:"auto",temporalDecay:{enabled:!0,halfLifeDays:30}},I5={enabled:!0,budget:800},O5={enabled:!1,autoPush:!0,autoPu... ... L1050: `),{success:!0,message:"Hooks installed successfully"}}function W0(A){let _=J0(A),$=V0(A);if(!$.hooks)return{success:!0,message:"No hooks to uninstall"};if($.hooks.SessionEnd){if($... L1051: `),{success:!0,message:"Hooks uninstalled successfully"}}function uA(A){let _=V0(A),$=w_(A),G=DG(A);return{sessionEnd:_.hooks?.SessionEnd?.some((K)=>K.hooks.some((Z)=>Z.command.inc... L1052: L1053: `)].join(` L1054: `)}function W_(A){let _=A.trim(),$=_.match(/\[\s*\{[\s\S]*\}\s*\]/),G=$?$[0]:_;try{let K=JSON.parse(G);if(!Array.isArray(K))return[];let Z=[];for(let Y of K){if(typeof Y.content!==... L1055:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1046

1050`),{success:!0,message:"Hooks installed successfully"}}function W0(A){let _=J0(A),$=V0(A);if(!$.hooks)return{success:!0,message:"No hooks to uninstall"};if($.hooks.SessionEnd){if($... L1051: `),{success:!0,message:"Hooks uninstalled successfully"}}function uA(A){let _=V0(A),$=w_(A),G=DG(A);return{sessionEnd:_.hooks?.SessionEnd?.some((K)=>K.hooks.some((Z)=>Z.command.inc... L1052: L1053: `)].join(` L1054: `)}function W_(A){let _=A.trim(),$=_.match(/\[\s*\{[\s\S]*\}\s*\]/),G=$?$[0]:_;try{let K=JSON.parse(G);if(!Array.isArray(K))return[];let Z=[];for(let Y of K){if(typeof Y.content!==... L1055:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1050

1050package = @chude/memory; repositoryIdentity = memory-nexus; dependency = @huggingface/transformers L1050: `),{success:!0,message:"Hooks installed successfully"}}function W0(A){let _=J0(A),$=V0(A);if(!$.hooks)return{success:!0,message:"No hooks to uninstall"};if($.hooks.SessionEnd){if($... L1051: `),{success:!0,message:"Hooks uninstalled successfully"}}function uA(A){let _=V0(A),$=w_(A),G=DG(A);return{sessionEnd:_.hooks?.SessionEnd?.some((K)=>K.hooks.some((Z)=>Z.command.inc... L1052:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L1050

1// @bun L2: var y8=Object.create;var{getPrototypeOf:w8,defineProperty:E1,getOwnPropertyNames:h8}=Object;var v8=Object.prototype.hasOwnProperty;var S$=(A,_,$)=>{$=A!=null?y8(w8(A)):{};let G=_||... L3: `);return $.length>0?$:null}return null}}class $_{static decodeProjectDirectory(A){return $A.fromEncoded(A)}static isEncodedPath(A){if(!A||A.length===0)return!1;if(I3.test(A))retur... L4: ... L46: `;if(G.length+Y.length>u3){G+=`... [content truncated] L47: `;break}G+=Y}return G}}var c3=0.001,u3=16000;var k6=()=>{};function l1(A,_,$=4){if(_<=0){let J=A.map((W)=>({...W,truncatedContent:W.content,allocated:W.content.length===0?0:Math.ce... L48: `)},Y=[],H=K.filter((X)=>X.type==="decision");if(H.length>0)Y.push(this.buildSection("decisions","Active Decisions",1,await Z(H)));let Q=K.filter((X)=>X.type==="learning");if(Q.len... ... L52: `)}countSectionLines(A,_){let $=A.find((G)=>G.key===_);if(!$||!$.content)return 0;return $.content.split(` L53: `).filter((G)=>G.trim().length>0).length}}class GG{projections;constructor(A){let _=new Set;for(let $ of A){if(!$.name||$.name.trim()==="")throw Error("Projection name is required"... L54: CREATE TABLE friction_log_new ( ... L508: CREATE INDEX

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

Findings

5 High4 Medium4 Low

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighCopied Package Dependency Bridgedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-21javascript

1// @bun

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

51. TOPICS: Key technical concepts discussed (1-5)

6 - Include only significant technical concepts, patterns, or technologies

7 - Each topic needs a name and confidence score (0-1)

92. TERMS: Domain-specific terminology defined or explained (0-3)

10 - Include only terms that were explicitly defined or explained

11 - Each term needs a name, definition, and confidence score (0-1)

133. DECISIONS: Explicit choices made with rationale (0-3)

14 - Include only decisions where a choice was made between alternatives

15 - Each decision needs: subject, decision, rejected alternatives, rationale, confidence

174. SUMMARY: 1-2 sentence summary of what was accomplished

19Output as JSON:

20{

21 "topics": [{ "name": "...", "confidence": 0.9 }],

Long lines were clipped for display.

Lines 1026-1073javascript

1026 AND s.start_time >= ?`:`JOIN sessions s ON l.source_type = 'session' AND l.source_id = s.id

1027 WHERE s.project_path_encoded = ?

1028 AND l.target_type = 'topic'`}

1029 ORDER BY l.weight DESC

1030 LIMIT ?

1031 `