registry / agentic-cortex / 6.1.1

agentic-cortex@6.1.1

⚠ Under review

Persistent self-improving agent memory — install & forget: auto-inject context via git hooks, zero-arg bootstrap, machine-wide global vault, 13 memory types, confidence tracking, XML codebase graphs

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 889 KB of source, external domains: 127.0.0.1, addyosmani.com, agenticai-flow.com, arxiv.org, developersdigest.substack.com, docs.cursor.com, docs.github.com, every.to, github.com, support.claude.com, www.anthropic.com, www.confluent.io

Source & flagged code

11 flagged

package.jsonView file

Lines 10-50json

10 "agent-context",

11 "rag",

12 "semantic-memory"

13 ],

14 "license": "MIT",

15 "author": "zallauddin",

16 "bin": {

17 "agentic-cortex": "cli.js",

18 "agentic-cortex-mcp": "src/mcp/server.js"

19 },

20 "main": "electron-main.js",

21 "dependencies": {

22 "@xenova/transformers": "^2.17.2",

23 "better-sqlite3": "^12.11.1"

24 },

25 "engines": {

26 "node": ">=18"

27 },

28 "scripts": {

29 "test": "node --test tests/*.test.js",

30 "postinstall": "node scripts/auto-setup.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

31 "tov-editor": "node src/tov/server.js",

32 "electron": "electron .",

33 "electron-dev": "electron . --devtools",

34 "cortex-ui": "electron electron-cortex.js",

35 "cortex-ui-dev": "electron electron-cortex.js --devtools",

36 "dist": "electron-builder"

37 },

38 "files": [

39 "cli.js",

40 "src/",

41 "scripts/",

42 "templates/",

43 "electron-cortex.js",

44 "preload-cortex.js",

45 "electron-main.js",

46 "preload.js",

47 "README.md"

48 ],

49 "devDependencies": {

50 "electron": "^43.2.0",

scripts/import-community-knowledge.jsView file

Lines 730-770javascript

730 // ═══════════════════════════════════════════════════════════════════

731

732 obs('decision', 'AI-Generated Code Quality Gates: Mandatory Verification Steps', `

733# Code Quality Gates for AI-Generated Code

734

735Before accepting ANY AI-generated code change, apply these gates:

736

737## Gate 1: Syntax & Compilation

738

preload.jsView file

Lines 1-26javascript

1/**

2 * preload.js — Secure IPC bridge for the ToV Save Editor Electron app.

3 * Exposes only the APIs the renderer needs via contextBridge.

4 */

5'use strict';

7const { contextBridge, ipcRenderer } = require('electron');

scripts/create-discovery-files.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * create-discovery-files.js — Shared module for creating multi-agent discovery files.

4 *

5 * Creates files that various AI coding agents automatically read at session start:

6 * - AGENTS.md (OpenCode, Claude Code — canonical MCP-first discovery)

7 * - .claude/CLAUDE.md (Claude Code)

8 * - .cursor/rules/agentic-cortex.mdc (Cursor, alwaysApply: true)

9 * - .opencode/agentic-cortex.md (OpenCode / Codebuff)

10 *

scripts/cortex-hook.shView file

•path = scripts/cortex-hook.sh kind = build_helper sizeBytes = 7908 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cortex-hook.shView on unpkg

scripts/seed-memory-repo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/seed-memory-repo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/seed-memory-repo.jsView on unpkg

cli.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = cli.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

electron-main.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = electron-main.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

electron-main.jsView on unpkg

src/sync/git-sync.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = src/sync/git-sync.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sync/git-sync.jsView on unpkg

Source & flagged code

11 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code