registry / samemind / 0.2.1

samemind@0.2.1

Git-native, zero-infra markdown memory for AI coding agents — one bundle, every engine, no database.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 467 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

README.mdView file

•instruction-override attempt (`ignore previous instructions`, `<system>`,

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

tools/hygiene.test.mjsView file

Lines 62-102javascript

62}

64// ---------------------------------------------------------------------------

65// 1. supersedes parsing (okf.mjs)

66// ---------------------------------------------------------------------------

68describe('supersedes — parse + normalize (okf.mjs)', () => {

69 let okf;

70 let root;

72 before(async () => {

73 root = mkdtempSync(join(tmpdir(), 'samemind-supersedes-unit-'));

74 writeConcept(root, 'concepts/old.md', { type: 'Concept', title: 'Old' });

75 writeConcept(root, 'concepts/other.md', { type: 'Concept', title: 'Other' });

76 writeConcept(root, 'concepts/new.md', {

77 type: 'Concept', title: 'New', supersedes: '/concepts/old.md',

78 });

79 writeConcept(root, 'concepts/new2.md', {

80 type: 'Concept', title: 'New2', supersedes: ['/concepts/old.md', '/concepts/other.md'],

81 });

82 process.env.OKF_ROOT = root;

83 okf = await import(`./lib/okf.mjs?t=${Date.now()}`);

84 });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/hygiene.test.mjsView on unpkg · L82

86 after(() => {

87 rmSync(root, { recursive: true, force: true });

88 });

90 it('scalar supersedes normalizes to a one-element array (doc + fm)', () => {

91 const docs = okf.load();

92 const n = docs.find(d => d.id === 'concepts/new');

93 assert.deepEqual(n.supersedes, ['/concepts/old.md']);

94 assert.deepEqual(n.fm.supersedes, ['/concepts/old.md']);

95 });

97 it('list supersedes stays a list', () => {

98 const docs = okf.load();

99 const n2 = docs.find(d => d.id === 'concepts/new2');

100 assert.deepEqual(n2.supersedes, ['/concepts/old.md', '/concepts/other.md']);

101 });

102

tools/mcp.test.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = samemind@0.1.2 matchedIdentity = npm:c2FtZW1pbmQ:0.1.2 similarity = 0.634 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tools/mcp.test.mjsView on unpkg

Source & flagged code

3 flagged · loading source

README.mdView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code