registry / @lh8ppl/core-memory-kit / 0.5.5

@lh8ppl/core-memory-kit@0.5.5

cmk — the CLI for core-memory-kit. Per-project, in-repo memory system for Claude Code.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 135 file(s), 1.59 MB of source, external domains: www.apple.com

Source & flagged code

4 flagged

src/poison-guard.mjsView file

Lines 86-126javascript

86 },

87 // AWS secret access key in a key=value shape. The value pattern is

88 // intentionally lenient (40-char Base64-ish) because real AWS secret

89 // keys are 40 chars of Base64. We require the `aws_secret` token

90 // nearby to gate on intent.

91 {

92 id:

Source & flagged code

4 flagged · loading source

src/poison-guard.mjsView file

106

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code