registry / @nxuss/lemma / 1.17.0

@nxuss/lemma@1.17.0

⚠ Under review

Intelligent AI Gateway for IDEs & Agents — Semantic cache, Privacy Firewall, Infrastructure Command Center, and Autonomous Cost-Optimization.

Static Scan Results

scanned 22d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 31 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 314 file(s), 3.58 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.lemma.dev, api.openai.com, bit.ly, dev.azure.com, docs.subconscious-router.dev, fb.me, generativelanguage.googleapis.com, github.com, gitlab.com, lemma.dev, lemma.nxus.studio, reactjs.org, socket.io, www.apple.com, www.w3.org

Source & flagged code

22 flagged

bin/init.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const path = require('path');

6const os = require('os');

7const { execSync, spawn } = require('child_process');

High

Child Process

Package source references child process execution.

bin/init.jsView on unpkg · L6

9const LEMMA_CACHE = path.join(os.homedir(), '.lemma-cache');

10const BRAIN_FILE = path.join(LEMMA_CACHE, 'lemma_brain.json');

11const ENV_FILE = path.join(LEMMA_CACHE, 'env');

12const MCP_SERVER_PATH = path.join(__dirname, '..', 'dist', 'cjs', 'mcp', 'index.js');

13const PROXY_PATH = path.join(__dirname, '..', 'cache-proxy.js');

14const PORT = '8081';

15const CYAN = '\x1b[36m', GREEN = '\x1b[32m', YELLOW = '\x1b[33m', DIM = '\x1b[2m', RESET

17function ensureDir(p) { try { fs.mkdirSync(p, { recursive: true }); } catch {} }

19function step(msg) { process.stderr.write(` ${CYAN}✦${RESET} ${msg}\n`); }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/init.jsView on unpkg · L6

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/init.jsView on unpkg · L6

21function ok(msg) { process.stderr.write(` ${GREEN}✓${RESET} ${msg}\n`); }

23function skip(msg) { process.stderr.write(` ${DIM}−${RESET} ${DIM}${msg}${RESET}\n`); }

25function warn(msg) { process.stderr.write(` ${YELLOW}⚠${RESET} ${msg}\n`); }

dist/esm/core/GhostListener.jsView file

Lines 1-40javascript

1import { spawn } from 'child_process';

2import { GhostAlchemist } from './GhostAlchemist.js';

3import { logger } from '../utils/logger.js';

4/**

5 * GhostListener

6 * Watches terminal output for errors and provides instant diagnostics.

sdks/crewai/dist/index.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/esm/proxy/ProjectStore.jsView file

Lines 1-24javascript

1/**

2 * Lemma ProjectStore

3 *

4 * Project-aware storage resolver:

5 * - Detects project identity from package.json → cwd basename fallback

6 * - Hashes project name to a 12-char hex prefix for path safety

7 * - Provides Stats and Usage persistence helpers

8 *

9 * Layout:

10 * ~/.lemma-cache/

11 * proxy.pid

dist/esm/cli/lemma-proxy.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2import { program } from 'commander';

3import express from 'express';

4import fs from 'fs';

5import path from

dist/esm/mcp/tools.jsView file

3231fs.writeFileSync(sandboxTsconfigPath, JSON.stringify(sandboxTsconfig, null, 2)); L3232: const tscOut = execSync(`npx tsc --noEmit --project "${sandboxTsconfigPath}" 2>&1 | head -40 || true`, { timeout: 20000, encoding: "utf8", cwd: sandboxDir }); L3233: const relevantErrors = tscOut

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/mcp/tools.jsView on unpkg · L3231

dist/cjs/cloud/server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cjs/cloud/server.js#virtual:normalized:round1View on unpkg

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @nxuss/lemma@1.23.0 matchedPath = bin/cli.js matchedIdentity = npm:QG54dXNzL2xlbW1h:1.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High