registry / @raajvamsy/memorylayer / 1.3.6

@raajvamsy/memorylayer@1.3.6

Persistent semantic memory for AI agents — npx memorylayer

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 342 KB of source, external domains: api.memorylayer.in, github.com

Oversized source lightweight scan

dist/cli.js6.72 MB file, sampled 256 KB

FilesystemNetworkEnvironmentVarsCryptoDynamicRequireHighEntropyStringsMinified

Source & flagged code

7 flagged

package.jsonView file

Lines 13-53json

13 "url": "https://github.com/raajvamsy/MemoryLayer/issues"

14 },

15 "publishConfig": {

16 "access": "public"

17 },

18 "bin": {

19 "memorylayer": "dist/cli.js"

20 },

21 "main": "./dist/cli.js",

22 "engines": {

23 "node": ">=18.0.0"

24 },

25 "scripts": {

26 "dev": "tsx src/cli.ts",

27 "build": "tsc --noEmit && node build.mjs",

28 "test": "NODE_ENV=test tsx --test src/*.test.ts src/**/*.test.ts",

29 "start": "node dist/cli.js",

30 "build:publish": "tsc --noEmit && node build.mjs --obfuscate && node scripts/build-modules.mjs",

31 "build:modules": "node scripts/build-modules.mjs",

32 "build:bundle": "tsc --noEmit && node build.mjs --obfuscate",

33 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "prepublishOnly": "node scripts/check-publish.mjs"

35 },

36 "keywords": [

37 "mcp",

38 "memory",

39 "ai",

40 "agents",

41 "llm",

42 "rag",

43 "semantic-search",

44 "claude",

45 "cursor",

46 "npx"

47 ],

48 "license": "MIT",

49 "files": [

50 "dist/cli.js",

51 "dist/premium/loader.js",

52 "dist/premium/contract.js",

53 "dist/modules",

dist/ide/cursor/hooks/pre_tool_use.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2// MemoryLayer Cursor preToolUse — deny Read/Grep/Glob/Shell until recall/code runs.

3const fs = require("fs");

4const {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ide/cursor/hooks/pre_tool_use.jsView on unpkg · L2

5 sessKey, flagPath, readStdinJson,

dist/premium/loader.jsView file

Lines 1-28javascript

1"use strict";import E from"crypto";import S from"zlib";import C from"vm";const M=E.verify.bind(E);import f from"fs";import k from"os";import y from"path"

dist/modules/code_ingest.1.blobView file

•path = dist/modules/code_ingest.1.blob kind = high_entropy_blob sizeBytes = 7537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/modules/code_ingest.1.blobView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 7043775 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 7043775 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ide/cursor/hooks/pre_tool_use.jsView file

2// MemoryLayer Cursor preToolUse — deny Read/Grep/Glob/Shell until recall/code runs. L3: const fs = require("fs"); L4: const {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ide/cursor/hooks/pre_tool_use.jsView on unpkg · L2

dist/premium/loader.jsView file

8awIDAQAB L9: -----END PUBLIC KEY-----`,I="https://api.memorylayer.in/modules/key",N="https://api.memorylayer.in/modules/blob",A=16*1024*1024;export class PremiumLoader{apiKey;machineId;modulesD... L10: "use strict"; ... L28: "setTimeout","setInterval","clearTimeout","clearInterval", L29: "setImmediate","clearImmediate","URL","URLSearchParams", L30: "TextDecoder","TextEncoder","Buffer","console", ... L44: globalThis.JSON = safeJSON; L45: `,t),t}constructor(t){this.apiKey=t.apiKey,this.machineId=t.machineId,this.modulesDir=t.modulesDir??D(),this.keyUrl=t.keyUrl??I,this.blobUrl=t.blobUrl??N,this.blobCacheDir=t.blobCa...

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/premium/loader.jsView on unpkg · L8

dist/modules/code_ingest.1.blobView file

•path = dist/modules/code_ingest.1.blob kind = high_entropy_blob sizeBytes = 7537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/modules/code_ingest.1.blobView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 7043775 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 7043775 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Findings

4 High7 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEval

HighShips High Entropy Blobdist/modules/code_ingest.1.blob

HighOversized Source Filedist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/ide/cursor/hooks/pre_tool_use.js

MediumUnsafe Vm Contextdist/premium/loader.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 13-53json

13 "url": "https://github.com/raajvamsy/MemoryLayer/issues"

14 },

15 "publishConfig": {

16 "access": "public"

17 },

18 "bin": {

19 "memorylayer": "dist/cli.js"

20 },

21 "main": "./dist/cli.js",

22 "engines": {

23 "node": ">=18.0.0"

24 },

25 "scripts": {

26 "dev": "tsx src/cli.ts",

27 "build": "tsc --noEmit && node build.mjs",

28 "test": "NODE_ENV=test tsx --test src/*.test.ts src/**/*.test.ts",

29 "start": "node dist/cli.js",

30 "build:publish": "tsc --noEmit && node build.mjs --obfuscate && node scripts/build-modules.mjs",

31 "build:modules": "node scripts/build-modules.mjs",

32 "build:bundle": "tsc --noEmit && node build.mjs --obfuscate",

33 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "prepublishOnly": "node scripts/check-publish.mjs"

35 },

36 "keywords": [

37 "mcp",

38 "memory",

39 "ai",

40 "agents",

41 "llm",

42 "rag",

43 "semantic-search",

44 "claude",

45 "cursor",

46 "npx"

47 ],

48 "license": "MIT",

49 "files": [

50 "dist/cli.js",

51 "dist/premium/loader.js",

52 "dist/premium/contract.js",

53 "dist/modules",

dist/ide/cursor/hooks/pre_tool_use.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2// MemoryLayer Cursor preToolUse — deny Read/Grep/Glob/Shell until recall/code runs.

3const fs = require("fs");

4const {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ide/cursor/hooks/pre_tool_use.jsView on unpkg · L2

5 sessKey, flagPath, readStdinJson,

dist/premium/loader.jsView file

Lines 1-28javascript

1"use strict";import E from"crypto";import S from"zlib";import C from"vm";const M=E.verify.bind(E);import f from"fs";import k from"os";import y from"path"

dist/modules/code_ingest.1.blobView file

•path = dist/modules/code_ingest.1.blob kind = high_entropy_blob sizeBytes = 7537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/modules/code_ingest.1.blobView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 7043775 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 7043775 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg