registry / @remnic/core / 9.7.15

@remnic/core@9.7.15

Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,513 file(s), 22.0 MB of source, external domains: 127.0.0.1, ampcode.com, anthropic.example, api.anthropic.com, api.github.com, api.notion.com, api.openai.com, claude.ai, codex.example, configured-anthropic.example, cursor.com, daemon.example, example.com, example.invalid, example.test, github.com, gmail.googleapis.com, internal.example.test, legacy-codex.example, materialized-claude-cli.example, materialized.example, merchant.example, notion.so, oauth2.googleapis.com, ollama.example, omp.sh, openai.com, openai.example, opik-active.example, pi.dev, prior.example, raw.example, raw.githubusercontent.com, replit.com, responses.example, roocode.com, runtime.example, tickets.example.com, upstream.example, vendor.example.com, windsurf.com

Source & flagged code

7 flagged

package.jsonView file

Lines 3004-3026json

3004 },

3005 "keywords": [

3006 "remnic",

3007 "memory",

3008 "ai",

3009 "agent",

3010 "core"

3011 ],

3012 "peerDependencies": {

3013 "@remnic/coding-graph": "^9.7.15"

3014 },

3015 "peerDependenciesMeta": {

3016 "@remnic/coding-graph": {

3017 "optional": true

3018 }

3019 },

3020 "scripts": {

3021 "build": "node ./scripts/build-with-heap.mjs",

3022 "check-types": "tsc --noEmit",

3023 "test": "tsx --test 'src/**/*.test.ts'",

3024 "postinstall": "node ./scripts/ensure-better-sqlite3.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L3024

3025 }

3026}

dist/chunk-UR6PBX2J.jsView file

Lines 365-405javascript

365 externalId: file.id,

366 externalRevision: typeof file.modifiedTime === "string" ? file.modifiedTime : void 0,

367 externalUrl: typeof file.webViewLink

dist/surfaces/dreams.jsView file

Lines 12-52javascript

12 const digest = createHash("sha1").update(

13 JSON.stringify({

14 timestamp: params.timestamp,

15 occurrence: params.occurrence

16 })

dist/chunk-7HYPN2GC.jsView file

Lines 12-52javascript

12 chmod,

13 copyFile,

14 lstat,

15 mkdir,

16 open,

17 readFile,

18 readdir,

19 rm,

20 stat,

21 unlink,

22 writeFile

23} from

scripts/faiss_index.pyView file

•path = scripts/faiss_index.py kind = build_helper sizeBytes = 31898 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/faiss_index.pyView on unpkg

src/admin/admin-surfaces.test.tsView file

Lines 42-82typescript

42}

44async function makeTempDir(): Promise<string> {

45 return mkdtemp(path.join(os.tmpdir(), "remnic-admin-test-"));

src/session-summaries/session-summaries.test.tsView file

Lines 1272-1312typescript

1272 flags: "i",

1273 replacement: "[REDACTED_LETTERS]",

1274 },

1275 ],

1276 },

1277 });

1278

1279 assert.equal

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code