@codemem/core@0.38.0: Suspicious npm security report (Warn)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 844 KB of source, external domains: api.anthropic.com, api.openai.com, chatgpt.com, opencode.ai

Source & flagged code

1 flagged

dist/index.jsView file

5189package = @codemem/core; repositoryIdentity = codemem; dependency = @xenova/transformers L5189: async function cc(e) { L5190: let { pipeline: t } = await import("@xenova/transformers"), n = await t("feature-extraction", e, { quantized: !1 }); L5191: return {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L5189

Source & flagged code

1 flagged · loading source

dist/index.jsView file

5189package = @codemem/core; repositoryIdentity = codemem; dependency = @xenova/transformers L5189: async function cc(e) { L5190: let { pipeline: t } = await import("@xenova/transformers"), n = await t("feature-extraction", e, { quantized: !1 }); L5191: return {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L5189

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings