nlm-memory: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

nlm-memory: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged · loading source

dist/install/setup.jsView file

12import { existsSync, mkdirSync, writeFileSync } from "node:fs"; L13: import { execFileSync } from "node:child_process"; L14: import { homedir, platform } from "node:os"; ... L30: async function fetchOllamaChatModels(timeoutMs = 5000) { L31: const baseUrl = process.env["NLM_OLLAMA_URL"] ?? "http://localhost:11434"; L32: const controller = new AbortController(); ... L37: return []; L38: const data = (await res.json()); L39: return (data.models ?? []) ... L53: const claudeProjectsPath = process.env["NLM_CLAUDE_PROJECTS_PATH"] L54: ?? join(homedir(), ".claude", "projects"); L55: const hermesPath = process.env["NLM_HERMES_SESSIONS_PATH"]

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install/setup.jsView on unpkg · L12

dist/cli/nlm.jsView file

30import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync, copyFileSync, realpathSync, appendFileSync } from "node:fs"; L31: import { execFileSync, spawn, spawnSync } from "node:child_process"; L32: import { Command } from "commander"; L33: import pkg from "../../package.json" with { type: "json" }; L34: import { serve } from "@hono/node-server"; ... L82: import { MemoSweepScheduler } from "../core/hook/memo-sweep.js"; L83: import { isAgentLoaded, isBenignBootoutError } from "./launchctl-helpers.js"; L84: import { DAEMON_PKILL_PATTERN, planRestart, executeRestartPlan } from "./restart-helpers.js"; ... L97: const __filename = fileURLToPath(import.meta.url); L98: const __dirname = dirname(__filename); L99: const MIGRATIONS_DIR = resolve(__dirname, "../../migrations"); ... L105

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/nlm.jsView on unpkg · L30

plugin-hermes-agent/__init__.pyView file

•path = plugin-hermes-agent/__init__.py kind = build_helper sizeBytes = 2644 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin-hermes-agent/__init__.pyView on unpkg

Source & flagged code

3 flagged

dist/install/setup.jsView file

Lines 1-32javascript

1/**

2 * `nlm setup` — interactive first-run wizard.

3 *

4 * Step order:

5 * 1. Select runtimes

6 * 2. Ollama preflight (install → start server → pull embedding model)

7 * 3. Classifier API key

8 * 4. DB migrations

9 * 5. Daemon (LaunchAgent on macOS / systemd hint on Linux / Task Scheduler hint on Windows)

10 * 6. Per-runtime MCP + hook wiring

11 */

12import { existsSync, mkdirSync, writeFileSync } from "node:fs";

13import { execFileSync } from "node:child_process";

14import { homedir, platform } from "node:os";

15import { dirname, join } from "node:path";

16import { cancel, confirm, intro, isCancel, log, multiselect, outro, password, select, spinner, } from "@clack/prompts";

17import { connectClaudeCode } from "./claude-code.js";

18import { connectHermes } from "./hermes.js";

19import { codexBinaryAvailable, connectCodex, pluginScriptsDir } from "./codex.js";

20import { connectPi } from "./pi.js";

21import { defaultDbPath as openCodeDefaultDbPath } from "../core/adapters/opencode.js";

22import { EMBEDDING_MODEL, embeddingModelPresent, ensureMcpToken, installOllama, ollamaBinaryAvailable, ollamaModelPresent, ollamaServerRunning, pullEmbeddingModel, pullOllamaModel, startOllamaServer, waitForOllamaServer, writeClassifierConfig, } from "./ollama.js";

23const RECOMMENDED_OLLAMA_CLASSIFIER = "qwen3.5:4b";

24import { installClaudeCodeHooks } from "./claude-code.js";

25import { hardenNlmDirPermissions } from "./nlm-dir-perms.js";

26const OS = platform();

27// Embedding-only tags shouldn't be offered as classifier models — they

28// can't run chat completions and the call would fail at first ingest.

29const EMBEDDING_MODEL_PREFIXES = ["nomic-embed", "mxbai-embed", "snowflake-arctic-embed", "bge-"];

30async function fetchOllamaChatModels(timeoutMs = 5000) {

31 const baseUrl = process.env["NLM_OLLAMA_URL"] ?? "http://localhost:11434";

32 const controller = new AbortController();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install/setup.jsView on unpkg · L12

dist/cli/nlm.jsView file

Lines 10-50javascript

10 * Subcommands:

11 * nlm start — boot HTTP server on $NLM_PORT (default 3940)

12 * nlm migrate — run pending migrations against the canonical SQLite

13 * nlm recall — one-shot recall query from the shell (debugging)

plugin-hermes-agent/__init__.pyView file

•path = plugin-hermes-agent/__init__.py kind = build_helper sizeBytes = 2644 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin-hermes-agent/__init__.pyView on unpkg