registry / aifp-mcp / 1.3.6

aifp-mcp@1.3.6

AiFP 记忆感知系统 — 没有记录，只做记忆感知 MCP Server

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 23 file(s), 167 KB of source, external domains: 43.143.222.90, hf-mirror.com, huggingface.co, your-server.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-37json

2 "name": "aifp-mcp",

3 "version": "1.3.6",

4 "description": "AiFP 记忆感知系统 — 没有记录，只做记忆感知 MCP Server",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "aifp-mcp": "dist/index.js"

9 },

10 "scripts": {

11 "start": "tsx src/index.ts",

12 "server": "tsx src/server.ts",

13 "setup": "tsx src/setup.ts",

14 "setup:dist": "node dist/setup.js",

15 "build": "tsc",

16 "prepublishOnly": "tsc",

17 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 },

19 "publishConfig": {

20 "access": "public"

21 },

22 "files": [

23 "dist/",

24 "scripts/",

25 "hooks/",

26 "README.md",

27 "package.json"

28 ],

29 "dependencies": {

30 "@modelcontextprotocol/sdk": "^1.29.0",

31 "@xenova/transformers": "^2.17.2"

32 },

33 "optionalDependencies": {

34 "@zvec/zvec": "^0.5.0"

35 },

36 "devDependencies": {

37 "@types/node": "^26.0.1",

scripts/postinstall.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * postinstall — 安装后自动完成全套配置：

4 * 1. 注册 Claude Code SessionStart hook

5 * 2. 注入启动指令到各 AI 工具的全局规则文件

6 * 3. 配置各工具的 MCP 连接

7 * 只在全局安装时生效（npm install -g aifp-mcp）

8 */

10import { existsSync, mkdirSync, writeFileSync, readFileSync, copyFileSync } from 'fs'

scripts/backfill-links.mjsView file

Lines 1-37javascript

1/**

2 * 回填脚本：把所有孤立记忆全部关联上

3 * 1. 去重合并相同内容的记忆

4 * 2. 所有孤立节点通过语义相似度/标签自动建立 CO_OCCURS_WITH 链接

5 *

6 * 运行：node scripts/backfill-links.mjs

7 */

8import { fileURLToPath } from 'url'

9import { dirname, resolve } from

dist/db.jsView file

•matchType = normalized_sha256 matchedPackage = aifp-mcp@1.3.3 matchedPath = dist/db.js matchedIdentity = npm:YWlmcC1tY3A:1.3.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/db.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code