registry / memnant / 1.17.0

memnant@1.17.0

It just remembers.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 560 KB of source, external domains: cdn.jsdelivr.net, huggingface.co, registry.npmjs.org

Source & flagged code

3 flagged

dist/snapshot/scanner.jsView file

Lines 1-29javascript

1/**

2 * memnant — Codebase snapshot scanner.

3 *

4 * Story 3.1: Scans the project file tree, computes hashes, reads

5 * package.json dependencies. Respects .gitignore and .memnantignore.

6 * Uses `git ls-files` in git repos for correctness, falls back to

7 * manual walk with ignore patterns.

8 */

9import { createHash } from 'crypto';

10import { execFileSync } from 'child_process';

11import { existsSync, readFileSync, readdirSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/snapshot/scanner.jsView on unpkg · L9

12import { join, relative } from 'path';

13/**

14 * Scan the project root and produce a SnapshotData.

15 */

16export function scanProject(projectRoot) {

17 const filePaths = listProjectFiles(projectRoot);

18 const files = [];

19 for (const relPath of filePaths) {

20 const absPath = join(projectRoot, relPath);

21 try {

22 const content = readFileSync(absPath);

23 const hash = createHash('sha256').update(content).digest('hex').slice(0, 16);

24 files.push({ path: relPath, hash });

25 }

26 catch {

27 // Skip files we can't read (permissions, etc.)

28 }

29 }

dist/governor/plugins.jsView file

Lines 1-41javascript

1/**

2 * memnant — Spec validator plugin system.

3 *

4 * Config-driven custom validators that plug into `memnant lint`.

5 * Plugins are project-local JS/TS files that export a SpecValidator.

6 */

7import { join } from 'path';

8import { pathToFileURL } from 'url'

dist/doctor/repair.jsView file

Lines 14-54javascript

14export function repairFinding(finding) {

15 if (!finding.fixable) {

16 return { code: finding.code, success: false, message: 'Manual fix required' };

17 }

Source & flagged code

3 flagged · loading source

dist/snapshot/scanner.jsView file

9import { createHash } from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import { existsSync, readFileSync, readdirSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/snapshot/scanner.jsView on unpkg · L9

dist/governor/plugins.jsView file

21const fileUrl = pathToFileURL(scriptPath).href; L22: const mod = await import(fileUrl); L23: const validator = mod.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/governor/plugins.jsView on unpkg · L21

dist/doctor/repair.jsView file

34try { L35: execFileSync('npx', ['tsc'], { cwd: root, timeout: 60000, encoding: 'utf-8' }); L36: return { code: 'DIST_MISSING', success: true, message: 'Rebuilt dist/ via tsc' };

Findings

3 High4 Medium5 Low

HighChild Processdist/snapshot/scanner.js

HighShell

HighRuntime Package Installdist/doctor/repair.js

MediumDynamic Requiredist/governor/plugins.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings