registry / memory-recall / 1.1.0

memory-recall@1.1.0

Local-first Recall Map, repo memory, and context for coding agents.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 98 file(s), 2.49 MB of source, external domains: 127.0.0.1, api.example.test, example.com, example.invalid, generativelanguage.googleapis.com, github.com, www.npmjs.com

Source & flagged code

9 flagged

scripts/native-smoke.mjsView file

Lines 33-77javascript

34 const pack = validateAgentPack(JSON.parse(await readFile('examples/agentpacks/content-intelligence.agentpack.json', 'utf8')));

35 const fingerprint = fingerprintAgentPack(pack);

36 if (!fingerprint.startsWith('sha256:')) throw new Error('Agent Pack fingerprint failed');

38 const model = new DeterministicModelProvider();

39 const health = await model.health();

40 if (health.status !== 'healthy') throw new Error('deterministic model provider unhealthy');

41 const profile = model.profile();

42 if (profile.providerId !== 'provider:native:model:deterministic' || profile.capabilities.structuredOutput !== true) {

43 throw new Error('deterministic model gateway profile failed');

44 }

46 const identity = await new LocalIdentityStore({

47 directory: path.join(directory, 'identity'),

48 scrypt: { N: 1024, r: 8, p: 1, keyLength: 32 }

49 }).init();

50 const bootstrap = await identity.bootstrapOwner({

51 username: 'owner',

52 displayName: 'Local Owner',

53 password: 'correct horse battery staple',

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/native-smoke.mjsView on unpkg · L53

54 workspaceId: 'ws_smoke',

55 workspaceName: 'Smoke Workspace'

56 });

57 const verified = await identity.verifyPassword({ username: 'owner', password: 'correct horse battery staple' });

Medium

Secret Pattern

Hardcoded password in scripts/native-smoke.mjs

scripts/native-smoke.mjsView on unpkg · L57

58 if (!verified.ok || bootstrap.membership.role !== 'owner') throw new Error('native identity smoke failed');

60 const policy = new DeterministicPolicyProvider({

61 clock: () => '2026-06-19T10:00:00.000Z',

62 decisionIdFactory: () => 'poldet_smoke'

63 });

64 const policyDecision = await policy.evaluate({

65 schemaVersion: '1.0.0',

66 requestId: 'polreq_smoke',

67 correlationId: 'req_native-smoke-000000',

68 operationId: 'nativeSmokePolicy',

69 principal: { userId: bootstrap.user.id, principalType: 'user', authenticationMethod: 'session', status: 'active' },

70 workspaceId: 'ws_smoke',

71 membership: { workspaceId: 'ws_smoke', role: 'owner', status: 'active' },

72 action: 'run.read',

73 resource: { type: 'run', id: 'run_smoke', workspaceId: 'ws_smoke', dataClass: 'workspace-private' },

74 environment: { deploymentProfile: 'local-dev', locality: 'local-only', interactive: true, externalWritesEnabled: false },

75 trustedTimestamp: '2026-06-19T10:00:00.000Z'

76 });

77 if (policyDecision.outcome !== 'allow') throw new Error('native policy smoke failed');

scripts/rust-semantic-ri-quality.mjsView file

Lines 1-21javascript

1import assert from 'node:assert/strict';

2import { spawnSync } from 'node:child_process';

3import { existsSync, mkdtempSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/rust-semantic-ri-quality.mjsView on unpkg · L1

4import os from 'node:os';

providers/native/context-candidate-ast-code/src/index.mjsView file

Lines 1902-1942javascript

1902 if (char === '{') delta += 1;

1903 else if (char === '}') delta -= 1;

1904 }

1905 return delta;

1906}

scripts/rust-realworld-bench.mjsView file

Lines 46-86javascript

46 question: {

47 id: 'express-router-middleware',

48 query: 'router middleware',

49 searchTerm: 'middleware',

50 expected: ['route:GET_middleware', 'module:examples_route_middleware_index']

51 }

MakefileView file

•path = Makefile kind = build_helper sizeBytes = 498 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

MakefileView on unpkg

scripts/consumer-browser-smoke.mjsView file

Lines 1-37javascript

1import { spawn, spawnSync } from 'node:child_process';

2import { createRequire } from 'node:module';

3import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';

4import http from 'node:http';

5import os from 'node:os';

scripts/consumer-smoke.mjsView file

Lines 1-37javascript

1import { spawn, spawnSync } from 'node:child_process';

2import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';

3import http from 'node:http';

4import os from 'node:os';

5import path from 'node:path';

Source & flagged code

9 flagged · loading source

scripts/native-smoke.mjsView file

53patternName = generic_password severity = medium line = 53 matchedText = password...le',

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/native-smoke.mjsView on unpkg · L53

57patternName = generic_password severity = medium line = 57 matchedText = const ve... });

Medium

Secret Pattern

Hardcoded password in scripts/native-smoke.mjs

scripts/native-smoke.mjsView on unpkg · L57

scripts/rust-semantic-ri-quality.mjsView file

1import assert from 'node:assert/strict'; L2: import { spawnSync } from 'node:child_process'; L3: import { existsSync, mkdtempSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/rust-semantic-ri-quality.mjsView on unpkg · L1

providers/native/context-candidate-ast-code/src/index.mjsView file

1922const imports = []; L1923: for (const match of String(body ?? '').matchAll(/^\s*import(?!\s*['"])(?:\s+type)?\s+([\s\S]*?)\s+from\s+['"]([^'"]+)['"]/gmu)) { L1924: const rawModule = match[2];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

providers/native/context-candidate-ast-code/src/index.mjsView on unpkg · L1922

scripts/rust-realworld-bench.mjsView file

66dir: 'kilo', L67: url: 'https://github.com/antirez/kilo.git', L68: question: { ... L77: function run(command, args, options = {}) { L78: const result = spawnSync(command, args, { L79: cwd: ROOT, ... L81: maxBuffer: 256 * 1024 * 1024, L82: env: { ...process.env, OAF_FIXED_NOW: FIXED_NOW }, L83: ...options

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/rust-realworld-bench.mjsView on unpkg · L66

MakefileView file

•path = Makefile kind = build_helper sizeBytes = 498 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

MakefileView on unpkg

scripts/consumer-browser-smoke.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = memory-recall@1.0.5 matchedIdentity = npm:bWVtb3J5LXJlY2FsbA:1.0.5 similarity = 0.677 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/consumer-browser-smoke.mjsView on unpkg

17patternName = generic_password severity = medium line = 17 matchedText = const pa...le';

Medium

Secret Pattern

Hardcoded password in scripts/consumer-browser-smoke.mjs

scripts/consumer-browser-smoke.mjsView on unpkg · L17

scripts/consumer-smoke.mjsView file

17patternName = generic_password severity = medium line = 17 matchedText = const pa...le';

Medium

Secret Pattern

Hardcoded password in scripts/consumer-smoke.mjs

scripts/consumer-smoke.mjsView on unpkg · L17

Findings

4 High9 Medium4 Low

HighChild Processscripts/rust-semantic-ri-quality.mjs

HighShell

HighSame File Env Network Executionscripts/rust-realworld-bench.mjs

HighPrevious Version Dangerous Deltascripts/consumer-browser-smoke.mjs

MediumSecret Patternscripts/native-smoke.mjs

MediumDynamic Requireproviders/native/context-candidate-ast-code/src/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build HelperMakefile

MediumStructural Risk Force Deep Review

MediumSecret Patternscripts/native-smoke.mjs

MediumSecret Patternscripts/consumer-smoke.mjs

MediumSecret Patternscripts/consumer-browser-smoke.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

scripts/native-smoke.mjsView file

Lines 33-77javascript

34 const pack = validateAgentPack(JSON.parse(await readFile('examples/agentpacks/content-intelligence.agentpack.json', 'utf8')));

35 const fingerprint = fingerprintAgentPack(pack);

36 if (!fingerprint.startsWith('sha256:')) throw new Error('Agent Pack fingerprint failed');

38 const model = new DeterministicModelProvider();

39 const health = await model.health();

40 if (health.status !== 'healthy') throw new Error('deterministic model provider unhealthy');

41 const profile = model.profile();

42 if (profile.providerId !== 'provider:native:model:deterministic' || profile.capabilities.structuredOutput !== true) {

43 throw new Error('deterministic model gateway profile failed');

44 }

46 const identity = await new LocalIdentityStore({

47 directory: path.join(directory, 'identity'),

48 scrypt: { N: 1024, r: 8, p: 1, keyLength: 32 }

49 }).init();

50 const bootstrap = await identity.bootstrapOwner({

51 username: 'owner',

52 displayName: 'Local Owner',

53 password: 'correct horse battery staple',

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/native-smoke.mjsView on unpkg · L53

54 workspaceId: 'ws_smoke',

55 workspaceName: 'Smoke Workspace'

56 });

57 const verified = await identity.verifyPassword({ username: 'owner', password: 'correct horse battery staple' });

Medium

Secret Pattern

Hardcoded password in scripts/native-smoke.mjs

scripts/native-smoke.mjsView on unpkg · L57

58 if (!verified.ok || bootstrap.membership.role !== 'owner') throw new Error('native identity smoke failed');

60 const policy = new DeterministicPolicyProvider({

61 clock: () => '2026-06-19T10:00:00.000Z',

62 decisionIdFactory: () => 'poldet_smoke'

63 });

64 const policyDecision = await policy.evaluate({

65 schemaVersion: '1.0.0',

66 requestId: 'polreq_smoke',

67 correlationId: 'req_native-smoke-000000',

68 operationId: 'nativeSmokePolicy',

69 principal: { userId: bootstrap.user.id, principalType: 'user', authenticationMethod: 'session', status: 'active' },

70 workspaceId: 'ws_smoke',

71 membership: { workspaceId: 'ws_smoke', role: 'owner', status: 'active' },

72 action: 'run.read',

73 resource: { type: 'run', id: 'run_smoke', workspaceId: 'ws_smoke', dataClass: 'workspace-private' },

74 environment: { deploymentProfile: 'local-dev', locality: 'local-only', interactive: true, externalWritesEnabled: false },

75 trustedTimestamp: '2026-06-19T10:00:00.000Z'

76 });

77 if (policyDecision.outcome !== 'allow') throw new Error('native policy smoke failed');

scripts/rust-semantic-ri-quality.mjsView file

Lines 1-21javascript

1import assert from 'node:assert/strict';

2import { spawnSync } from 'node:child_process';

3import { existsSync, mkdtempSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/rust-semantic-ri-quality.mjsView on unpkg · L1

4import os from 'node:os';

providers/native/context-candidate-ast-code/src/index.mjsView file

Lines 1902-1942javascript

1902 if (char === '{') delta += 1;

1903 else if (char === '}') delta -= 1;

1904 }

1905 return delta;

1906}

scripts/rust-realworld-bench.mjsView file

Lines 46-86javascript

46 question: {

47 id: 'express-router-middleware',

48 query: 'router middleware',

49 searchTerm: 'middleware',

50 expected: ['route:GET_middleware', 'module:examples_route_middleware_index']

51 }

MakefileView file

•path = Makefile kind = build_helper sizeBytes = 498 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

MakefileView on unpkg

scripts/consumer-browser-smoke.mjsView file

Lines 1-37javascript

1import { spawn, spawnSync } from 'node:child_process';

2import { createRequire } from 'node:module';

3import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';

4import http from 'node:http';

5import os from 'node:os';

scripts/consumer-smoke.mjsView file

Lines 1-37javascript

1import { spawn, spawnSync } from 'node:child_process';

2import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';

3import http from 'node:http';

4import os from 'node:os';

5import path from 'node:path';