registry / @pyxmate/memory / 1.12.0

@pyxmate/memory@1.12.0

SDK for pyx-memory — Memory as a Service for AI agents

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 136 KB of source, external domains: memory.api.pyxmate.com

Source & flagged code

2 flagged

dist/cli/pyx-mem.mjsView file

Lines 74-114javascript

74function isHeadlessLinuxDaemon(cause) {

75 if (process.platform !== "linux") return false;

76 const msg = causeMessage(cause).toLowerCase();

77 return msg.includes("dbus") || msg.includes("session bus") || msg.includes("no such interface");

78}

79function causeMessage(cause) {

80 if (cause instanceof Error) return cause.message;

81 if (typeof cause === "string") return cause;

82 return "";

83}

85// src/cli/keychain/types.ts

86var KEYCHAIN_SERVICE = "pyx-memory";

87var KEYCHAIN_ACCOUNT = "default";

88var CREDENTIAL_SCHEMA_VERSION = 1;

90// src/cli/keychain/napi-provider.ts

91var cached = null;

92async function loadEntry() {

93 if (cached) return cached;

94 try {

95 const mod = await import("@napi-rs/keyring");

96 cached = new mod.Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli/pyx-mem.mjsView on unpkg · L94

97 return cached;

98 } catch (err) {

99 throw providerImportError(err);

100 }

101}

102function parseRecord(raw) {

103 let parsed;

104 try {

105 parsed = JSON.parse(raw);

106 } catch (err) {

107 throw recordInvalidError(err);

108 }

109 if (!isValidRecord(parsed)) throw recordInvalidError();

110 return parsed;

111}

112function isValidRecord(value) {

113 if (typeof value !== "object" || value === null) return false;

114 const v = value;

•matchType = previous_version_dangerous_delta matchedPackage = @pyxmate/memory@1.10.0 matchedIdentity = npm:QHB5eG1hdGUvbWVtb3J5:1.10.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/pyx-mem.mjsView on unpkg

Source & flagged code

2 flagged · loading source

dist/cli/pyx-mem.mjsView file

94package = @pyxmate/memory; repositoryIdentity = pyx-memory-v1; dependency = @napi-rs/keyring L94: try { L95: const mod = await import("@napi-rs/keyring"); L96: cached = new mod.Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli/pyx-mem.mjsView on unpkg · L94

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/pyx-mem.mjsView on unpkg

Findings

2 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/cli/pyx-mem.mjs

HighPrevious Version Dangerous Deltadist/cli/pyx-mem.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/cli/pyx-mem.mjsView file

Lines 74-114javascript

74function isHeadlessLinuxDaemon(cause) {

75 if (process.platform !== "linux") return false;

76 const msg = causeMessage(cause).toLowerCase();

77 return msg.includes("dbus") || msg.includes("session bus") || msg.includes("no such interface");

78}

79function causeMessage(cause) {

80 if (cause instanceof Error) return cause.message;

81 if (typeof cause === "string") return cause;

82 return "";

83}

85// src/cli/keychain/types.ts

86var KEYCHAIN_SERVICE = "pyx-memory";

87var KEYCHAIN_ACCOUNT = "default";

88var CREDENTIAL_SCHEMA_VERSION = 1;

90// src/cli/keychain/napi-provider.ts

91var cached = null;

92async function loadEntry() {

93 if (cached) return cached;

94 try {

95 const mod = await import("@napi-rs/keyring");

96 cached = new mod.Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli/pyx-mem.mjsView on unpkg · L94

97 return cached;

98 } catch (err) {

99 throw providerImportError(err);

100 }

101}

102function parseRecord(raw) {

103 let parsed;

104 try {

105 parsed = JSON.parse(raw);

106 } catch (err) {

107 throw recordInvalidError(err);

108 }

109 if (!isValidRecord(parsed)) throw recordInvalidError();

110 return parsed;

111}

112function isValidRecord(value) {

113 if (typeof value !== "object" || value === null) return false;

114 const v = value;

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/pyx-mem.mjsView on unpkg