persnally@2.10.0
Your own context engine — local-first, across every AI. So every AI finally knows you.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbuild/src/importers/git.jsView file
5*/
L6: import { execFileSync } from "node:child_process";
L7: import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
build/src/importers/git.jsView on unpkg · L5build/src/lifecycle.jsView file
52const log = openSync(LOG_FILE, "a");
L53: const child = spawn(process.execPath, [cliPath, "serve", "--port", String(port)], {
L54: detached: true,
L55: stdio: ["ignore", log, log],
L56: env: process.env,
L57: });
...
L62: try {
L63: const r = await fetch(`http://127.0.0.1:${port}/health`);
L64: if (r.ok)
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
build/src/lifecycle.jsView on unpkg · L525*/
L6: import { execFileSync, spawn } from "node:child_process";
L7: import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
...
L13: const PLIST_LABEL = "com.persnally.daemon";
L14: const PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
L15: const UNIT_NAME = "persnally.service";
...
L17: function unitPath() {
L18: return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "systemd", "user", UNIT_NAME);
L19: }
...
L62: try {
L63: const r = await fetch(`http://127.0.0.1:${port}/health`);
L64: if (r.ok)
Findings
5 High4 Medium5 Low
HighChild Processbuild/src/importers/git.js
HighShell
HighSame File Env Network Executionbuild/src/lifecycle.js
HighSandbox Evasion Gated Capabilitybuild/src/lifecycle.js
HighPrevious Version Dangerous Deltabuild/src/cli.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebuild/src/lifecycle.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to persnally@2.10.0.
See all versions of persnally for other recorded verdicts.
- Review the evidence and your use of persnally@2.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.