registry / @memi-design/cli / 2.6.1

@memi-design/cli@2.6.1

Interface understanding and design-system memory for AI coding agents: UX audits, Tailwind tokens, shadcn registries, MCP, and Agent Skills.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 293 file(s), 2.84 MB of source, external domains: 127.0.0.1, agenticui.net, api.anthropic.com, api.figma.com, api.github.com, cli.github.com, console.anthropic.com, design.penpot.app, example.com, github.com, linear.app, memoire.cv, raw.githubusercontent.com, registry.npmjs.org, stripe.com, ui.shadcn.com, v0.dev, www.apple.com, www.figma.com, www.memoire.cv, www.npmjs.com, www.w3.org

Source & flagged code

5 flagged

mcpb/server/index.cjsView file

Lines 1-21javascript

1const { spawn } = require("node:child_process");

High

Child Process

Package source references child process execution.

mcpb/server/index.cjsView on unpkg · L1

3const executable = process.platform === "win32" ? "npx.cmd" : "npx";

4const args = [

5 "-y",

6 "@memi-design/cli@2.6.1",

7 "mcp", "start", "--no-figma",

8];

10const child = spawn(executable, args, {

11 env: process.env,

12 stdio: "inherit",

13 windowsHide: true,

14});

16child.once("error", (error) => {

17 console.error(`Failed to start Memi through ${executable}: ${error.message}`);

18 process.exitCode = 1;

19});

21child.once("exit", (code, signal) => {

dist/preview/server.jsView file

Lines 66-109javascript

66 </header>

68 <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">

69 ${galleryItems.join("\n ")}

70 </div>

dist/research/design-package.jsView file

Lines 190-230javascript

190 layout: "dashboard",

191 sections: [

192 { name: "Hero", component: "ResearchHero", repeat: 1, layout: "full-width", props: { evidenceIds: backing.slice(0, 3) } },

dist/utils/update-check.jsView file

Lines 1-34javascript

1/**

2 * CLI self-update plumbing.

3 *

4 * Two responsibilities:

5 * 1. A throttled, non-blocking "update available" notice shown on startup

6 * (reads a cached result; refreshes it in a detached background process so

7 * the hot path never waits on the network).

8 * 2. Shared helpers for the `memi self-update` command.

9 *

10 * Behaviour is opt-out via MEMOIRE_NO_UPDATE_CHECK=1 and opt-in auto-apply via

Source & flagged code

5 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code