registry / opencode-fractal-memory / 0.7.4

opencode-fractal-memory@0.7.4

Fractal memory system for OpenCode with semantic search and automatic compression.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 233 file(s), 2.67 MB of source, external domains: 127.0.0.1, cdnjs.cloudflare.com, huggingface.co, raw.githubusercontent.com, web.dev, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 19-59json

19 "opencode-plugin",

20 "memory",

21 "embeddings",

22 "semantic-search",

23 "hnsw",

24 "vector-search",

25 "bm25",

26 "agent-memory"

27 ],

28 "license": "MIT",

29 "repository": {

30 "type": "git",

31 "url": "git+https://github.com/holgerreppert/opencode-fractal-memory.git"

32 },

33 "trustedDependencies": [],

34 "scripts": {

35 "build": "tsc",

36 "lint": "oxlint --config oxlintrc.json",

37 "lint:fix": "oxlint --fix-dangerously --config oxlintrc.json",

38 "prepublishOnly": "npm run build && npm run typecheck",

39 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 "test": "bun test",

41 "typecheck": "tsc --noEmit",

42 "view": "bun run dist/management-standalone.js",

43 "mcp": "bun run dist/mcp-server.js"

44 },

45 "dependencies": {

46 "@huggingface/tokenizers": "^0.1.3",

47 "@kreuzberg/tree-sitter-language-pack-wasm": "^1.10.3",

48 "@modelcontextprotocol/sdk": "^1.29.0",

49 "@types/three": "^0.185.1",

50 "graphology": "^0.26.0",

51 "graphology-communities-louvain": "^2.0.2",

52 "graphology-shortest-path": "^2.1.0",

53 "graphology-traversal": "^0.3.1",

54 "hnsw": "^1.1.1",

55 "js-yaml": "^4.2.0",

56 "onnxruntime-node": "^1.27.0",

57 "onnxruntime-web": "^1.27.0",

58 "three": "^0.185.1",

59 "zod": "4.3.6"

management/public/d3.min.jsView file

Lines 1-3javascript

2!function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&define.amd?define(["exports"],n):n((t="undefined"

dist/management-standalone.bundle.mjsView file

29var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L30: var __require = /* @__PURE__ */ createRequire(import.meta.url); L31:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/management-standalone.bundle.mjsView on unpkg · L29

scripts/opencode-backup.shView file

•path = scripts/opencode-backup.sh kind = build_helper sizeBytes = 1629 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/opencode-backup.shView on unpkg

management/public/models/brain-atlas.glbView file

•path = management/public/models/brain-atlas.glb kind = high_entropy_blob sizeBytes = 103464 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

management/public/models/brain-atlas.glbView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

management/public/d3.min.jsView file

1// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock L2: !function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&define.amd?define(["exports"],n):n((t="undefined"!=typeof globalThis?globa...

Low

Eval

Package source references a known benign dynamic code generation pattern.

management/public/d3.min.jsView on unpkg · L1

dist/management-standalone.bundle.mjsView file

29var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L30: var __require = /* @__PURE__ */ createRequire(import.meta.url); L31:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/management-standalone.bundle.mjsView on unpkg · L29

scripts/opencode-backup.shView file

•path = scripts/opencode-backup.sh kind = build_helper sizeBytes = 1629 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/opencode-backup.shView on unpkg

management/public/models/brain-atlas.glbView file

•path = management/public/models/brain-atlas.glb kind = high_entropy_blob sizeBytes = 103464 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

management/public/models/brain-atlas.glbView on unpkg

Findings

2 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobmanagement/public/models/brain-atlas.glb

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/management-standalone.bundle.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/opencode-backup.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalmanagement/public/d3.min.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 19-59json

19 "opencode-plugin",

20 "memory",

21 "embeddings",

22 "semantic-search",

23 "hnsw",

24 "vector-search",

25 "bm25",

26 "agent-memory"

27 ],

28 "license": "MIT",

29 "repository": {

30 "type": "git",

31 "url": "git+https://github.com/holgerreppert/opencode-fractal-memory.git"

32 },

33 "trustedDependencies": [],

34 "scripts": {

35 "build": "tsc",

36 "lint": "oxlint --config oxlintrc.json",

37 "lint:fix": "oxlint --fix-dangerously --config oxlintrc.json",

38 "prepublishOnly": "npm run build && npm run typecheck",

39 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 "test": "bun test",

41 "typecheck": "tsc --noEmit",

42 "view": "bun run dist/management-standalone.js",

43 "mcp": "bun run dist/mcp-server.js"

44 },

45 "dependencies": {

46 "@huggingface/tokenizers": "^0.1.3",

47 "@kreuzberg/tree-sitter-language-pack-wasm": "^1.10.3",

48 "@modelcontextprotocol/sdk": "^1.29.0",

49 "@types/three": "^0.185.1",

50 "graphology": "^0.26.0",

51 "graphology-communities-louvain": "^2.0.2",

52 "graphology-shortest-path": "^2.1.0",

53 "graphology-traversal": "^0.3.1",

54 "hnsw": "^1.1.1",

55 "js-yaml": "^4.2.0",

56 "onnxruntime-node": "^1.27.0",

57 "onnxruntime-web": "^1.27.0",

58 "three": "^0.185.1",

59 "zod": "4.3.6"

management/public/d3.min.jsView file

Lines 1-3javascript

2!function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&define.amd?define(["exports"],n):n((t="undefined"

dist/management-standalone.bundle.mjsView file

29var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L30: var __require = /* @__PURE__ */ createRequire(import.meta.url); L31:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/management-standalone.bundle.mjsView on unpkg · L29

scripts/opencode-backup.shView file

•path = scripts/opencode-backup.sh kind = build_helper sizeBytes = 1629 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/opencode-backup.shView on unpkg

management/public/models/brain-atlas.glbView file

•path = management/public/models/brain-atlas.glb kind = high_entropy_blob sizeBytes = 103464 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

management/public/models/brain-atlas.glbView on unpkg