Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@melandlabs/opencontext@0.1.1: Suspicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 11 finding(s) warrant review before installing.

View on npm All versions

registry / @melandlabs/opencontext / 0.1.1

@melandlabs/opencontext@0.1.1

OpenContext — single-package facade that bundles the contracts, memory-store, retrieval, loop engine, and agent runtime. Install once, get every capability.

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 512 KB of source

Oversized source lightweight scan

dist/cli/opencontext.js4.41 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsShellHighEntropyStrings

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

dist/index.js

5.51 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsShellHighEntropyStrings

Source & flagged code

3 flagged · loading source

dist/cli/opencontext.jsView file

3Cross-file remote execution chain: dist/cli/opencontext.js spawns dist/index.js; helper contains network access plus dynamic code execution. L3: import Stream, { Readable as Readable$1 } from 'stream'; L4: import http from 'http'; L5: import Url from 'url'; ... L27: import 'pg'; L28: import { spawn, execSync } from 'child_process'; L29: import { serve } from '@hono/node-server'; ... L2557: // ../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js L2558: function __classPrivateFieldGet(receiver, state, kind2, f4) { L2559: if (typeof state === "function" ? receiver !== state || !f4 : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it"); ... L2737: break; L2738: await file.write(value); L2739: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/opencontext.jsView on unpkg · L3

•path = dist/cli/opencontext.js kind = oversized_cli_entrypoint sizeBytes = 4622708 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli/opencontext.jsView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 5776382 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

Findings

3 High5 Medium3 Low

HighChild Process

HighShell

HighCross File Remote Execution Contextdist/cli/opencontext.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.js

MediumOversized Cli Entrypointdist/cli/opencontext.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Maintainersnora-lazai-xyz

Version0.7.0

PublishedAug 10, 2026

LicenseApache-2.0

Dependencies7

Integrityverified

Package size6.46 MB

Files9

Keywordsopencontextmelandlabsmemoryragagenttemporal-graphmcpllm

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → opencontext

RuntimeNo engine / OS / CPU constraints

Artifact34.2 MB · 9 files1 signature(s)

Install lifecycleNo install hooks · other: build, lint, lint:fix, typecheck

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkShellHighEntropyStringsManifest: clean

LPM CLI

Source & flagged code

3 flagged

dist/cli/opencontext.jsView file

3Cross-file remote execution chain: dist/cli/opencontext.js spawns dist/index.js; helper contains network access plus dynamic code execution. L3: import Stream, { Readable as Readable$1 } from 'stream'; L4: import http from 'http'; L5: import Url from 'url'; ... L27: import 'pg'; L28: import { spawn, execSync } from 'child_process'; L29: import { serve } from '@hono/node-server'; ... L2557: // ../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js L2558: function __classPrivateFieldGet(receiver, state, kind2, f4) { L2559: if (typeof state === "function" ? receiver !== state || !f4 : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it"); ... L2737: break; L2738: await file.write(value); L2739: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/opencontext.jsView on unpkg · L3

•path = dist/cli/opencontext.js kind = oversized_cli_entrypoint sizeBytes = 4622708 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli/opencontext.jsView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 5776382 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg