registry / @jungjaehoon/mama-core / 1.8.1

@jungjaehoon/mama-core@1.8.1

MAMA Core - Shared modules for Memory-Augmented MCP Assistant

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 131 file(s), 1.25 MB of source, external domains: api.anthropic.com

Source & flagged code

1 flagged

dist/db-adapter/node-sqlite-adapter.jsView file

Lines 6-46javascript

6 */

7var __importDefault = (this && this.__importDefault) || function (mod) {

8 return (mod && mod.__esModule) ? mod : { "default": mod };

9};

10Object.defineProperty(exports, "__esModule", { value: true });

11exports.NodeSQLiteAdapter = void 0;

12const path_1 = __importDefault(require("path"));

13const os_1 = __importDefault(require("os"));

14const fs_1 = __importDefault(require("fs"));

15const base_adapter_js_1 = require("./base-adapter.js");

16const node_sqlite_statement_js_1 = require("./node-sqlite-statement.js");

17const debug_logger_js_1 = require("../debug-logger.js");

18const embeddings_js_1 = require("../embeddings.js");

19const LEGACY_DB_PATH = path_1.default.join(os_1.default.homedir(), '.spinelift', 'memories.db');

20const DEFAULT_DB_PATH = path_1.default.join(os_1.default.homedir(), '.claude', 'mama-memory.db');

21const SQLITE_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;

22// Prefer better-sqlite3 (includes FTS5) over node:sqlite (lacks FTS5)

23let BetterSQLite3 = null;

24let DatabaseSync = null;

25try {

26 // eslint-disable-next-line @typescript-eslint/no-require-imports

27 const bs3 = require('better-sqlite3');

28 BetterSQLite3 = 'default' in bs3 ? bs3.default : bs3;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/db-adapter/node-sqlite-adapter.jsView on unpkg · L26

29}

30catch {

31 BetterSQLite3 = null;

32}

33if (!BetterSQLite3) {

34 try {

35 // eslint-disable-next-line @typescript-eslint/no-require-imports

36 ({ DatabaseSync } = require('node:sqlite'));

37 }

38 catch {

39 DatabaseSync = null;

40 }

41}

42class NodeSQLiteConnection {

43 db;

44 connected = true;

45 isBetterSQLite3;

46 constructor(db) {

Source & flagged code

1 flagged · loading source

dist/db-adapter/node-sqlite-adapter.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code