registry / @reallexi/rmai / 1.3.84

@reallexi/rmai@1.3.84

Standalone Real Memory AI Agent CLI for project chat, coding workflows, provider configuration, and safe Git operations.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.89 MB of source, external domains: 127.0.0.1, api.openai.com, github.com, integrate.api.nvidia.com, openrouter.ai, reactjs.org

Source & flagged code

3 flagged

bin/rmai.mjsView file

940var EventEmitter3 = __require("events").EventEmitter; L941: var childProcess = __require("child_process"); L942: var path8 = __require("path");

High

Child Process

Package source references child process execution.

bin/rmai.mjsView on unpkg · L940

1800args.unshift(executableFile); L1801: args = incrementNodeInspectorPort(process13.execArgv).concat(args); L1802: proc = childProcess.spawn(process13.argv[0], args, { stdio: "inherit" });

High

Shell

Package source references shell execution.

bin/rmai.mjsView on unpkg · L1800

940var EventEmitter3 = __require("events").EventEmitter; L941: var childProcess = __require("child_process"); L942: var path8 = __require("path"); ... L40451: if (filePath && origin?.line && fs.existsSync(filePath)) { L40452: const sourceCode = fs.readFileSync(filePath, "utf8"); L40453: excerpt = dist_default3(sourceCode, origin.line); ... L41556: modelFlow: "auto", L41557: ollamaBaseUrl: "http://localhost:11434", L41558: llamaCppBaseUrl: "http://127.0.0.1:8080/v1", ... L43584: "When useful, confirm the goal, give a small plan, explain findings, and summarize results clearly.", L43585: "The CLI has explicit local tools for file access, approved writes, approved shell commands, settings, and session export.", L43586: "File tools are confined to the current project. Shell commands start t

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

bin/rmai.mjsView on unpkg · L940

Source & flagged code

3 flagged · loading source

bin/rmai.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code