registry / memgrep / 1.0.1

memgrep@1.0.1

Telegram → Cursor agent + searchable local memory for playbooks you reuse (and schedule with memgrep jobs).

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 208 KB of source, external domains: 127.0.0.1, api.telegram.org, cursor.com, t.me

Source & flagged code

2 flagged

dist/telegram/launchd.jsView file

Lines 1-23javascript

1import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

2import { homedir } from 'node:os';

3import path from 'node:path';

4import { spawnSync } from 'node:child_process';

5import { fileURLToPath } from 'node:url';

6import { defaultHome } from '../memory/store.js';

7import { sanitizeTelegramProfile } from './config.js';

8export const LAUNCHD_LABEL = 'com.memgrep.telegram';

9function escapeXml(value) {

10 return value

11 .replace(/&/g, '&')

12 .replace(/</g, '<')

13 .replace(/>/g, '>')

14 .replace(/"/g, '"');

15}

16export function launchAgentsDir(home = homedir()) {

17 return path.join(home, 'Library', 'LaunchAgents');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/telegram/launchd.jsView on unpkg · L3

18}

19export function launchdPlistPath(agentsDir = launchAgentsDir()) {

20 return path.join(agentsDir, `${LAUNCHD_LABEL}.plist`);

21}

22export function telegramServiceLogPath(home = defaultHome()) {

23 return path.join(home, 'logs', 'telegram-launchd.log');

dist/jobs/launchd.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = memgrep@1.0.0 matchedIdentity = npm:bWVtZ3JlcA:1.0.0 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/jobs/launchd.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/telegram/launchd.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code