registry / squish-memory / 1.9.0

squish-memory@1.9.0

AI memory system for coding agents. Local-first MCP runtime with connectors (Google Drive, GitHub, Slack, Notion), knowledge graphs, decay scoring, and multi-tier deployment. Free locally, paid Cloud for sync and teams.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 373 file(s), 2.52 MB of source, external domains: 127.0.0.1, aiplatform.googleapis.com, api.openai.com, api.squish.dev, api.squishplugin.dev, cdn.tailwindcss.com, d3js.org, fonts.googleapis.com, fonts.gstatic.com, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

3 flagged

core/ingestion/signal-engine.tsView file

Lines 133-173typescript

133

134 return {

135 shouldEnrich: true,

136 entityTerms,

137 reason: 'durable signal with identifiable entities',

138 };

139}

140

141export function hashSignalContent(content: string): string {

142 return createHash('sha1').update(content).digest('hex');

143}

144

145export function classifySignalEvent(input: SignalEventInput): SignalDecision {

146 const toolName = input.toolName;

147 const command = String(input.toolInput?.command ?? input.toolInput?.cmd ?? '');

148 const content = normalizeContent(input.toolResult);

149 const normalized = `${command}\n${content}`.toLowerCase();

150 const reasons: string[] = [];

151

152 const noisyCommand =

153 /\b(npm|bun|pnpm|yarn)\s+(install|add)\b/.test(normalized) ||

155 if (noisyCommand) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/ingestion/signal-engine.tsView on unpkg · L153

156 const placeHint = inferPlaceHint(toolName, normalized);

157 reasons.push('noise filtered from install/build output');

158 return {

159 classification: 'discard',

160 reasons,

161 storeRaw: false,

162 importance: 'low',

163 wakeUpPriority: 'low',

164 placeHint,

165 graphHint: inferGraphHint(normalized, content, 'discard'),

166 content,

167 contentHash: hashSignalContent(normalized),

168 estimatedSavings: content.length,

169 };

170 }

171

172 if (/\b(current hypothesis|hypothesis:|investigate|trying next)\b/.test(normalized)) {

173 const placeHint = inferPlaceHint(toolName, normalized);

core/embeddings/transformers-local.tsView file

Lines 1-33typescript

1/**

2 * Transformers.js Local Embedding Provider

3 *

4 * Uses ONNX-based transformer models for high-quality local embeddings.

5 * Supports Hugging Face ONNX embedding models.

6 *

7 * Usage:

8 * Set SQUISH_EMBEDDINGS_PROVIDER=transformers

9 * Required: SQUISH_LOCAL_MODEL=<huggingface-onnx-model>

10 *

11 * Download models automatically on first use. Models cached in HuggingFace cache directory.

plugin/claude-code/scripts/session-stop.shView file

•path = plugin/claude-code/scripts/session-stop.sh kind = build_helper sizeBytes = 318 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/claude-code/scripts/session-stop.shView on unpkg

Source & flagged code

3 flagged · loading source

core/ingestion/signal-engine.tsView file

153/\b(npm|bun|pnpm|yarn)\s+(install|add)\b/.test(normalized) || L154: /\bdownload(ed|ing)?\b|\bfetch(ed|ing)?\b|\bprogress\b|\bresolved\b/.test(normalized); L155: if (noisyCommand) { ... L303: if (input.nuanceSuppressed) return true; L304: return /\b(raw|original|full|stack trace|traceback|stderr|stdout|rewind)\b/i.test(input.query); L305: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/ingestion/signal-engine.tsView on unpkg · L153

core/embeddings/transformers-local.tsView file

13package = squish-memory; repositoryIdentity = squish; dependency = @huggingface/transformers L13: L14: import { pipeline } from '@huggingface/transformers'; L15: import { logger } from '../logger.js';

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/embeddings/transformers-local.tsView on unpkg · L13

plugin/claude-code/scripts/session-stop.shView file

•path = plugin/claude-code/scripts/session-stop.sh kind = build_helper sizeBytes = 318 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/claude-code/scripts/session-stop.shView on unpkg

Findings

1 High4 Medium5 Low

HighCopied Package Dependency Bridgecore/embeddings/transformers-local.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperplugin/claude-code/scripts/session-stop.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptocore/ingestion/signal-engine.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

core/ingestion/signal-engine.tsView file

Lines 133-173typescript

133

134 return {

135 shouldEnrich: true,

136 entityTerms,

137 reason: 'durable signal with identifiable entities',

138 };

139}

140

141export function hashSignalContent(content: string): string {

142 return createHash('sha1').update(content).digest('hex');

143}

144

145export function classifySignalEvent(input: SignalEventInput): SignalDecision {

146 const toolName = input.toolName;

147 const command = String(input.toolInput?.command ?? input.toolInput?.cmd ?? '');

148 const content = normalizeContent(input.toolResult);

149 const normalized = `${command}\n${content}`.toLowerCase();

150 const reasons: string[] = [];

151

152 const noisyCommand =

153 /\b(npm|bun|pnpm|yarn)\s+(install|add)\b/.test(normalized) ||

155 if (noisyCommand) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/ingestion/signal-engine.tsView on unpkg · L153

156 const placeHint = inferPlaceHint(toolName, normalized);

157 reasons.push('noise filtered from install/build output');

158 return {

159 classification: 'discard',

160 reasons,

161 storeRaw: false,

162 importance: 'low',

163 wakeUpPriority: 'low',

164 placeHint,

165 graphHint: inferGraphHint(normalized, content, 'discard'),

166 content,

167 contentHash: hashSignalContent(normalized),

168 estimatedSavings: content.length,

169 };

170 }

171

172 if (/\b(current hypothesis|hypothesis:|investigate|trying next)\b/.test(normalized)) {

173 const placeHint = inferPlaceHint(toolName, normalized);

core/embeddings/transformers-local.tsView file

Lines 1-33typescript

1/**

2 * Transformers.js Local Embedding Provider

3 *

4 * Uses ONNX-based transformer models for high-quality local embeddings.

5 * Supports Hugging Face ONNX embedding models.

6 *

7 * Usage:

8 * Set SQUISH_EMBEDDINGS_PROVIDER=transformers

9 * Required: SQUISH_LOCAL_MODEL=<huggingface-onnx-model>

10 *

11 * Download models automatically on first use. Models cached in HuggingFace cache directory.

plugin/claude-code/scripts/session-stop.shView file

•path = plugin/claude-code/scripts/session-stop.sh kind = build_helper sizeBytes = 318 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/claude-code/scripts/session-stop.shView on unpkg