registry / @remnic/core / 9.3.653

@remnic/core@9.3.653

⚠ Under review

Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,192 file(s), 16.2 MB of source, external domains: 127.0.0.1, ampcode.com, anthropic.example, api.anthropic.com, api.github.com, api.notion.com, api.openai.com, claude.ai, codex.example, configured-anthropic.example, cursor.com, daemon.example, example.com, example.invalid, example.test, github.com, gmail.googleapis.com, internal.example.test, legacy-codex.example, materialized-claude-cli.example, materialized.example, merchant.example, notion.so, oauth2.googleapis.com, ollama.example, openai.com, openai.example, opik-active.example, pi.dev, prior.example, raw.example, raw.githubusercontent.com, replit.com, responses.example, roocode.com, runtime.example, tickets.example.com, upstream.example, vendor.example.com, windsurf.com

Source & flagged code

7 flagged

package.jsonView file

Lines 2891-2913json

2891 "tsx": "^4.21.0",

2892 "typescript": "^5.9.3"

2893 },

2894 "license": "MIT",

2895 "repository": {

2896 "type": "git",

2897 "url": "https://github.com/joshuaswarren/remnic.git",

2898 "directory": "packages/remnic-core"

2899 },

2900 "keywords": [

2901 "remnic",

2902 "memory",

2903 "ai",

2904 "agent",

2905 "core"

2906 ],

2907 "scripts": {

2908 "build": "tsup",

2909 "check-types": "tsc --noEmit",

2910 "test": "tsx --test 'src/**/*.test.ts'",

2911 "postinstall": "node ./scripts/ensure-better-sqlite3.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L2911

2912 }

2913}

dist/chunk-TQNRI55H.jsView file

Lines 412-452javascript

412 externalId: file.id,

413 externalRevision: typeof file.modifiedTime === "string" ? file.modifiedTime : void 0,

414 externalUrl: typeof file.webViewLink === "string" ? file.webViewLink : void

dist/surfaces/dreams.jsView file

Lines 12-52javascript

12 const digest = createHash("sha1").update(

13 JSON.stringify({

14 timestamp: params.timestamp,

15 occurrence: params.occurrence

16 })

17 ).digest("hex").slice(0,

dist/chunk-7HYPN2GC.jsView file

Lines 12-52javascript

12 chmod,

13 copyFile,

14 lstat,

15 mkdir,

16 open,

17 readFile,

18 readdir,

19 rm,

20 stat,

21 unlink,

22 writeFile

23} from "fs/promises";

scripts/faiss_index.pyView file

•path = scripts/faiss_index.py kind = build_helper sizeBytes = 31898 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/faiss_index.pyView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @remnic/core@9.3.655 matchedIdentity = npm:QHJlbW5pYy9jb3Jl:9.3.655 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

src/session-summaries/session-summaries.test.tsView file

Lines 1272-1312typescript

1272 flags: "i",

1273 replacement: "[REDACTED_LETTERS]",

1274 },

1275 ],

1276 },

1277 });

1278

1279 assert.equal(report.drafts[0].excerpts?.[0].text, "Hide [REDACTED_LETTERS] and [REDACTED_LETTERS]."

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/ensure-better-sqlite3.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunk-TQNRI55H.jsView file

432try { L433: mod = await import( L434: /* @vite-ignore */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-TQNRI55H.jsView on unpkg · L432

dist/surfaces/dreams.jsView file

32title, L33: body: normalizeBody(params.body), L34: tags: params.tags,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/surfaces/dreams.jsView on unpkg · L32

dist/chunk-7HYPN2GC.jsView file

32function resolvePlatform(options) { L33: return options?.platform ?? process.platform; L34: } L35: function resolveMigrationHome(options) { L36: return options?.homeDir ?? resolveHomeDir(); L37: } ... L50: if (result.status !== 0) { L51: const reason = result.status === null ? `signal ${result.signal ?? "unknown"}` : `exit code ${result.status}`; L52: throw new Error(`migration command failed: ${command} ${args.join(" ")} (${reason})`); ... L380: try { L381: raw = JSON.parse(await readFile(filePath, "utf8")); L382: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-7HYPN2GC.jsView on unpkg · L32

scripts/faiss_index.pyView file

•path = scripts/faiss_index.py kind = build_helper sizeBytes = 31898 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/faiss_index.pyView on unpkg

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

src/session-summaries/session-summaries.test.tsView file

1292patternName = generic_password severity = medium line = 1292 matchedText = content:...t.',

Medium

Secret Pattern

Hardcoded password in src/session-summaries/session-summaries.test.ts

src/session-summaries/session-summaries.test.tsView on unpkg · L1292

Findings

1 Critical1 High7 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requiredist/chunk-TQNRI55H.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/chunk-7HYPN2GC.js

MediumShips Build Helperscripts/faiss_index.py

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/session-summaries/session-summaries.test.ts

LowScripts Present

LowWeak Cryptodist/surfaces/dreams.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 2891-2913json

2891 "tsx": "^4.21.0",

2892 "typescript": "^5.9.3"

2893 },

2894 "license": "MIT",

2895 "repository": {

2896 "type": "git",

2897 "url": "https://github.com/joshuaswarren/remnic.git",

2898 "directory": "packages/remnic-core"

2899 },

2900 "keywords": [

2901 "remnic",

2902 "memory",

2903 "ai",

2904 "agent",

2905 "core"

2906 ],

2907 "scripts": {

2908 "build": "tsup",

2909 "check-types": "tsc --noEmit",

2910 "test": "tsx --test 'src/**/*.test.ts'",

2911 "postinstall": "node ./scripts/ensure-better-sqlite3.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L2911

2912 }

2913}

dist/chunk-TQNRI55H.jsView file

Lines 412-452javascript

412 externalId: file.id,

413 externalRevision: typeof file.modifiedTime === "string" ? file.modifiedTime : void 0,

414 externalUrl: typeof file.webViewLink === "string" ? file.webViewLink : void

dist/surfaces/dreams.jsView file

Lines 12-52javascript

12 const digest = createHash("sha1").update(

13 JSON.stringify({

14 timestamp: params.timestamp,

15 occurrence: params.occurrence

16 })

17 ).digest("hex").slice(0,

dist/chunk-7HYPN2GC.jsView file

Lines 12-52javascript

12 chmod,

13 copyFile,

14 lstat,

15 mkdir,

16 open,

17 readFile,

18 readdir,

19 rm,

20 stat,

21 unlink,

22 writeFile

23} from "fs/promises";

scripts/faiss_index.pyView file

•path = scripts/faiss_index.py kind = build_helper sizeBytes = 31898 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/faiss_index.pyView on unpkg

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

src/session-summaries/session-summaries.test.tsView file

Lines 1272-1312typescript

1272 flags: "i",

1273 replacement: "[REDACTED_LETTERS]",

1274 },

1275 ],

1276 },

1277 });

1278

1279 assert.equal(report.drafts[0].excerpts?.[0].text, "Hide [REDACTED_LETTERS] and [REDACTED_LETTERS]."