registry / superlocalmemory / 3.7.4

superlocalmemory@3.7.4

Deprecated due to stability issues. Upgrade to superlocalmemory@3.8.1.

Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 20 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 52 file(s), 1.17 MB of source, external domains: api.anthropic.com, api.openai.com, github.com, openrouter.ai, popper.js.org, superlocalmemory.com, www.python.org, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

Lines 32-72json

32 "url": "https://varunpratap.com"

33 },

34 "license": "AGPL-3.0-or-later",

35 "repository": {

36 "type": "git",

37 "url": "https://github.com/qualixar/superlocalmemory.git"

38 },

39 "homepage": "https://superlocalmemory.com",

40 "mcpName": "io.github.qualixar/superlocalmemory",

41 "bugs": {

42 "url": "https://github.com/qualixar/superlocalmemory/issues"

43 },

44 "bin": {

45 "slm": "./bin/slm-npm",

46 "superlocalmemory": "./bin/slm-npm"

47 },

48 "scripts": {

49 "build:plugin": "node scripts/build-plugin.mjs",

50 "check:plugin": "node scripts/build-plugin.mjs --check",

51 "prepack": "node scripts/build-plugin.mjs && node scripts/prepack.js",

52 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L52

53 "preuninstall": "node scripts/preuninstall.js",

54 "test": "node --test 'tests/ui/*.mjs'"

55 },

56 "engines": {

57 "node": ">=18.0.0",

58 "npm": ">=9.0.0"

59 },

60 "os": [

61 "darwin",

62 "linux",

63 "win32"

64 ],

65 "files": [

66 "bin/slm-npm",

67 "src/superlocalmemory/",

68 "!src/**/__pycache__/",

69 "!src/**/*.pyc",

70 "!src/**/*.pyo",

71 "ide/completions/",

72 "ide/configs/",

src/superlocalmemory/ui/vendor/d3.v7.min.jsView file

Lines 1-3javascript

2!function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&

ide/hooks/memory-profile-skill.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Memory Profile CLI Skill (V3)

4 * Provides memory-profile commands for managing multiple memory contexts

5 */

7const { execFile } = require('child_process');

8const {

ide/completions/slm.zshView file

•path = ide/completions/slm.zsh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ide/completions/slm.zshView on unpkg

src/superlocalmemory/ui/vendor/bootstrap-icons/fonts/bootstrap-icons.woff2View file

•path = [redacted]-icons/fonts/bootstrap-icons.woff2 kind = high_entropy_blob sizeBytes = 121084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/superlocalmemory/ui/vendor/bootstrap-icons/fonts/bootstrap-icons.woff2View on unpkg

ide/hooks/memory-list-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-list-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-list-skill.jsView on unpkg

ide/hooks/memory-recall-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-recall-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-recall-skill.jsView on unpkg

ide/hooks/memory-remember-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-remember-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-remember-skill.jsView on unpkg

ide/hooks/memory-reset-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-reset-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-reset-skill.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code