registry / memoryrouter-codex / 1.1.0
memoryrouter-codex@1.1.0
Automatic, project-scoped MemoryRouter memory for OpenAI Codex
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
2 flaggedruntime/project.cjsView file
4const crypto = require('crypto');
L5: const { execFileSync } = require('child_process');
L6:
High
Child Process
Package source references child process execution.
runtime/project.cjsView on unpkg · L4lib/installer.cjsView file
124L125: function codexInfo(cwd, env = process.env) {
L126: try {
L127: const output = execFileSync('codex', ['--version'], { cwd, env, encoding: 'utf8', timeout: 5000 }).trim();
L128: return { installed: true, output, version: parseVersion(output) };
...
L135: try {
L136: const response = await fetch(url, { ...init, signal: controller.signal });
L137: let data = null;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/installer.cjsView on unpkg · L124Findings
2 High2 Medium4 Low
HighChild Processruntime/project.cjs
HighSame File Env Network Executionlib/installer.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to memoryrouter-codex@1.1.0.
See all versions of memoryrouter-codex for other recorded verdicts.
- Review the evidence and your use of memoryrouter-codex@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.