superlocalmemory@4.0.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

superlocalmemory@4.0.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/superlocalmemory/ui/vendor/d3.v7.min.jsView file

1// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock L2: !function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&define.amd?define(["exports"],n):n((t="undefined"!=typeof globalThis?globa...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/superlocalmemory/ui/vendor/d3.v7.min.jsView on unpkg · L1

ide/hooks/memory-profile-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-profile-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-profile-skill.jsView on unpkg

6L7: const { execFile } = require('child_process'); L8: const { promisify } = require('util');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

ide/hooks/memory-profile-skill.jsView on unpkg · L6

ide/completions/slm.zshView file

•path = ide/completions/slm.zsh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ide/completions/slm.zshView on unpkg

ide/hooks/memory-list-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-list-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-list-skill.jsView on unpkg

ide/hooks/memory-recall-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-recall-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-recall-skill.jsView on unpkg

ide/hooks/memory-remember-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-remember-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-remember-skill.jsView on unpkg

ide/hooks/memory-reset-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-reset-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-reset-skill.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 34-74json

34 "license": "AGPL-3.0-or-later",

35 "repository": {

36 "type": "git",

37 "url": "https://github.com/qualixar/superlocalmemory.git"

38 },

39 "homepage": "https://superlocalmemory.com",

40 "mcpName": "io.github.qualixar/superlocalmemory",

41 "bugs": {

42 "url": "https://github.com/qualixar/superlocalmemory/issues"

43 },

44 "bin": {

45 "slm": "./bin/slm-npm",

46 "superlocalmemory": "./bin/slm-npm"

47 },

48 "scripts": {

49 "build:plugin": "node scripts/build-plugin.mjs",

50 "check:plugin": "node scripts/build-plugin.mjs --check",

51 "build:copilot-plugin": "node scripts/build-copilot-plugin.mjs",

52 "check:copilot-plugin": "node scripts/build-copilot-plugin.mjs --check",

53 "prepack": "node scripts/build-plugin.mjs && node scripts/build-copilot-plugin.mjs && node scripts/prepack.js",

54 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "preuninstall": "node scripts/preuninstall.js",

56 "test": "node scripts/run-ui-tests.mjs"

57 },

58 "engines": {

59 "node": ">=18.0.0",

60 "npm": ">=9.0.0"

61 },

62 "os": [

63 "darwin",

64 "linux",

65 "win32"

66 ],

67 "files": [

68 "bin/slm-npm",

69 "src/superlocalmemory/",

70 "!src/**/__pycache__/",

71 "!src/**/*.pyc",

72 "!src/**/*.pyo",

73 "ide/completions/",

74 "ide/configs/",

src/superlocalmemory/ui/vendor/d3.v7.min.jsView file

Lines 1-3javascript

1// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock

2!function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&

ide/hooks/memory-profile-skill.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Memory Profile CLI Skill (V3)

4 * Provides memory-profile commands for managing multiple memory contexts

5 */

6

7const { execFile } = require('child_process');

8const {

ide/completions/slm.zshView file

•path = ide/completions/slm.zsh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ide/completions/slm.zshView on unpkg

ide/hooks/memory-list-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-list-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-list-skill.jsView on unpkg

ide/hooks/memory-recall-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-recall-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-recall-skill.jsView on unpkg

ide/hooks/memory-remember-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-remember-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-remember-skill.jsView on unpkg

ide/hooks/memory-reset-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-reset-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-reset-skill.jsView on unpkg