registry  /  obsidian-rag  /  0.1.8

obsidian-rag@0.1.8

RAG/memory MCP server on top of an Obsidian vault. Semantic search, note CRUD, memory recall — all local, all offline.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 884 KB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

4 flagged · loading source
dist/bundle.jsView file
24710// dist/cli.js L24711: import { execFile } from "node:child_process"; L24712: import { promisify } from "node:util";
High
Child Process

Package source references child process execution.

dist/bundle.jsView on unpkg · L24710
1234// validation function arguments L1235: data: new codegen_1.Name("data"), L1236: // data passed to validation function ... L2261: id = normalizeId(id); L2262: return resolver.resolve(baseId, id); L2263: } ... L3124: for (i = 0; i < input.length; i++) { L3125: code = input[i].charCodeAt(0); L3126: if (code === 48) { ... L8239: if (ast.body[0].expression.body.type === "BlockStatement") { L8240: return new Function(params, source.slice(body[0] + 1, body[1] - 1)); L8241: }
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/bundle.jsView on unpkg · L1234
24987const { execSync } = req("child_process"); L24988: execSync("npm install --omit=dev --no-audit --no-fund", { L24989: cwd: pluginRoot,
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bundle.jsView on unpkg · L24987
8239if (ast.body[0].expression.body.type === "BlockStatement") { L8240: return new Function(params, source.slice(body[0] + 1, body[1] - 1)); L8241: }
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/bundle.jsView on unpkg · L8239

Findings

4 High2 Medium6 Low
HighChild Processdist/bundle.js
HighShell
HighObfuscated Payload Loaderdist/bundle.js
HighRuntime Package Installdist/bundle.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/bundle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings