registry / @memi-design/cli / 2.1.1

@memi-design/cli@2.1.1

Interface understanding and design-system memory for AI coding agents: UX audits, Tailwind tokens, shadcn registries, MCP, and Agent Skills.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 270 file(s), 2.85 MB of source, external domains: 127.0.0.1, agenticui.net, api.anthropic.com, api.figma.com, api.github.com, cli.github.com, console.anthropic.com, design.penpot.app, example.com, github.com, linear.app, memoire.cv, raw.githubusercontent.com, react.dev, registry.npmjs.org, stripe.com, ui.shadcn.com, v0.dev, www.apple.com, www.figma.com, www.memoire.cv, www.npmjs.com, www.w3.org

Source & flagged code

5 flagged

dist/studio/design-system-trace.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/studio/design-system-trace.jsView on unpkg · L1

3const execFileAsync = promisify(execFile);

4export async function collectDesignSystemTrace(projectRoot) {

5 const generatedAt = new Date().toISOString();

6 try {

7 const [statusOutput, numstatOutput] = await Promise.all([

8 runGit(projectRoot, ["status", "--short"]),

9 runGit(projectRoot, ["diff", "--numstat", "--", "."]),

10 ]);

11 const files = mergeStatusAndNumstat(statusOutput, numstatOutput);

12 const insertions = files.reduce((sum, file) => sum + file.insertions, 0);

13 const deletions = files.reduce((sum, file) => sum + file.deletions, 0);

14 const designSystemFiles = files.filter((file) => file.designSystem);

15 return {

16 generatedAt,

17 projectRoot,

18 status: files.length > 0 ? "changed" : "clean",

19 filesChanged: files.length,

20 insertions,

21 deletions,

dist/preview/server.jsView file

Lines 66-109javascript

66 </header>

68 <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">

69 ${galleryItems.join("\n ")}

70 </div>

72 {galleryItems.length === 0

dist/research/design-package.jsView file

Lines 169-209javascript

169 layout: "dashboard",

170 sections: [

171 { name: "Hero", component: "ResearchHero", repeat: 1, layout: "full-width", props: { evidenceIds: backing.slice(0, 3) } },

172 { name: "Decision", component: "DecisionPanel", repeat: 1, layout: "grid-2"

dist/utils/update-check.jsView file

Lines 1-34javascript

1/**

2 * CLI self-update plumbing.

3 *

4 * Two responsibilities:

5 * 1. A throttled, non-blocking "update available" notice shown on startup

6 * (reads a cached result; refreshes it in a detached background process so

7 * the hot path never waits on the network).

8 * 2. Shared helpers for the `memi self-update` command.

9 *

10 * Behaviour is opt-out via MEMOIRE_NO_UPDATE_CHECK=1 and opt-in auto-apply via

11 * MEMOIRE_AUTO_UPDATE=1. The notifier must NEVER throw or block the CLI.

Source & flagged code

5 flagged · loading source

dist/studio/design-system-trace.jsView file

1import { execFile } from "node:child_process"; L2: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/studio/design-system-trace.jsView on unpkg · L1

dist/preview/server.jsView file

89stdio: "pipe", L90: shell: true, L91: });

High

Shell

Package source references shell execution.

dist/preview/server.jsView on unpkg · L89

86const previewDir = join(this.projectRoot, "preview"); L87: this.process = spawn("npx", ["vite", "--port", String(this.port)], { L88: cwd: previewDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/preview/server.jsView on unpkg · L86

dist/research/design-package.jsView file

189interactions: ["hover-tooltip"], L190: sampleData: [{ label: metric.label || metric.field, value: metric.mean }], L191: tags: ["research-vibe-design", metric.id],

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/research/design-package.jsView on unpkg · L189

dist/utils/update-check.jsView file

14import { dirname, join } from "node:path"; L15: import { spawn } from "node:child_process"; L16: import { isStandaloneBinary } from "./runtime.js"; ... L18: export const PKG_NAME = "@memi-design/cli"; L19: const REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`; L20: const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // once per day ... L25: function homeDir() { L26: return process.env.HOME || process.env.USERPROFILE || ""; L27: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/utils/update-check.jsView on unpkg · L14

Findings

4 High3 Medium7 Low

HighChild Processdist/studio/design-system-trace.js

HighShelldist/preview/server.js

HighSame File Env Network Executiondist/utils/update-check.js

HighRuntime Package Installdist/preview/server.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/research/design-package.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/studio/design-system-trace.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/studio/design-system-trace.jsView on unpkg · L1

3const execFileAsync = promisify(execFile);

4export async function collectDesignSystemTrace(projectRoot) {

5 const generatedAt = new Date().toISOString();

6 try {

7 const [statusOutput, numstatOutput] = await Promise.all([

8 runGit(projectRoot, ["status", "--short"]),

9 runGit(projectRoot, ["diff", "--numstat", "--", "."]),

10 ]);

11 const files = mergeStatusAndNumstat(statusOutput, numstatOutput);

12 const insertions = files.reduce((sum, file) => sum + file.insertions, 0);

13 const deletions = files.reduce((sum, file) => sum + file.deletions, 0);

14 const designSystemFiles = files.filter((file) => file.designSystem);

15 return {

16 generatedAt,

17 projectRoot,

18 status: files.length > 0 ? "changed" : "clean",

19 filesChanged: files.length,

20 insertions,

21 deletions,

dist/preview/server.jsView file

Lines 66-109javascript

66 </header>

68 <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">

69 ${galleryItems.join("\n ")}

70 </div>

72 {galleryItems.length === 0

dist/research/design-package.jsView file

Lines 169-209javascript

169 layout: "dashboard",

170 sections: [

171 { name: "Hero", component: "ResearchHero", repeat: 1, layout: "full-width", props: { evidenceIds: backing.slice(0, 3) } },

172 { name: "Decision", component: "DecisionPanel", repeat: 1, layout: "grid-2"

dist/utils/update-check.jsView file

Lines 1-34javascript

1/**

2 * CLI self-update plumbing.

3 *

4 * Two responsibilities:

5 * 1. A throttled, non-blocking "update available" notice shown on startup

6 * (reads a cached result; refreshes it in a detached background process so

7 * the hot path never waits on the network).

8 * 2. Shared helpers for the `memi self-update` command.

9 *

10 * Behaviour is opt-out via MEMOIRE_NO_UPDATE_CHECK=1 and opt-in auto-apply via

11 * MEMOIRE_AUTO_UPDATE=1. The notifier must NEVER throw or block the CLI.