registry  /  @proofofwork-agency/reporecall  /  0.8.0

@proofofwork-agency/reporecall@0.8.0

Local codebase memory, intent-routed retrieval, generated wiki, and MCP tools for coding agents

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 1.98 MB of source, external domains: 127.0.0.1, api.openai.com, d3js.org

Source & flagged code

3 flagged · loading source
dist/memory.jsView file
50import { existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs"; L51: import { spawnSync } from "child_process"; L52: function isAbiMismatchError(message) {
High
Child Process

Package source references child process execution.

dist/memory.jsView on unpkg · L50
122"Fix it by reinstalling consistently, for example:", L123: " pnpm install --force", L124: "or rebuild just the native binding:", ... L133: const openProbe = options.openProbe ?? openWithPragmas; L134: const runCommand = options.runCommand ?? ((command, args, spawnOptions) => spawnSync(command, args, { ...spawnOptions, timeout: 3e4 })); L135: const repair = tryRepairSqliteRuntime(cwd, env, runCommand);
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/memory.jsView on unpkg · L122
15if (logger) return logger; L16: const destination = process.env.MEMORY_LOG_DEST === "stderr" ? ( L17: // Async (buffered) stderr destination. Synchronous writes block the ... L50: import { existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs"; L51: import { spawnSync } from "child_process"; L52: function isAbiMismatchError(message) { ... L54: } L55: function detectPreferredPackageManager(cwd = process.cwd(), env = process.env) { L56: const userAgent = env.npm[redacted] ?? ""; L57: if (userAgent.startsWith("pnpm/")) return "pnpm"; ... L63: if (existsSync8(`${cwd}/bun.lockb`) || existsSync8(`${cwd}/bun.lock`)) return "bun"; L64: if (existsSync8(`${cwd}/package-lock.json`)) return "npm";
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/memory.jsView on unpkg · L15

Findings

3 High4 Medium5 Low
HighChild Processdist/memory.js
HighShell
HighRuntime Package Installdist/memory.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/memory.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings