Loading npm security reports…
Persistent self-improving agent memory with tree-of-thoughts reasoning: MCTS/beam search, PRM step verification, self-consistency voting, s1 budget forcing, REPL program-aided reasoning, reflexion self-correction, failure classification, experience replay
Static analysis completed at 0.0% confidence. No malicious behavior was detected; 22 low-signal pattern(s) were surfaced and cleared.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
src/core/hooks.jsView on unpkg · L185Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/create-discovery-files.jsView on unpkg · L5Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
scripts/create-discovery-files.jsView on unpkgPackage ships non-JavaScript build or shell helper files.
scripts/cortex-hook.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/core/code-index.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
cli.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/import-community-knowledge.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/seed-memory-repo.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/core/failure-classifier.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/auto-setup.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/inject-memory.mjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/core/repl-executor.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/generate-graph.mjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/bench/locomo.jsView on unpkgThis report applies to agentic-cortex@7.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L32Package ships non-JavaScript build or shell helper files.
scripts/cortex-hook.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/core/code-index.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
cli.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/import-community-knowledge.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/seed-memory-repo.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/core/failure-classifier.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/auto-setup.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/inject-memory.mjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/core/repl-executor.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/generate-graph.mjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
src/bench/locomo.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
src/core/hooks.jsView on unpkg · L185Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/create-discovery-files.jsView on unpkg · L5Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
scripts/create-discovery-files.jsView on unpkg