superlocalmemory@4.1.14
Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete credential theft, foreign agent-control mutation, or destructive install behavior is visible in the inspected source. However, an automatic lifecycle hook downloads and installs an unreviewed remote runtime, leaving a real supply-chain execution risk.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation, rebuild, or any install that runs postinstall
Impact
An external package-index artifact can introduce executable code during installation outside the reviewed npm tarball.
Mechanism
postinstall pip bootstrap of a remote same-named package
AI rationale
No concrete credential theft, foreign agent-control mutation, or destructive install behavior is visible in the inspected source. However, an automatic lifecycle hook downloads and installs an unreviewed remote runtime, leaving a real supply-chain execution risk.
Evidence
package.jsonscripts/postinstall.js.slm-venv/
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The npm postinstall hook automatically launches a package-owned Python runtime installer.
- That installer uses pip to fetch and install a same-named Python package at install time, so code absent from this npm tarball becomes part of the installation.
- The downloaded package source is selected from an external package index unless a local wheel environment variable is supplied.
Evidence against
- The installer writes its runtime beneath the package directory and checks that the runtime path is not a symlink.
- The visible JavaScript skill wrappers use argument-vector process execution rather than shell interpolation.
- The interactive configurator is a separate script, and the visible lifecycle hook does not invoke it.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgide/hooks/memory-profile-skill.jsView file
•matchType = normalized_sha256
matchedPackage = superlocalmemory@3.6.23
matchedPath = ide/hooks/memory-profile-skill.js
matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
8 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedscripts/postinstall-interactive.js#virtual:normalized:round1
HighKnown Malware Source Similarityide/hooks/memory-list-skill.js
HighKnown Malware Source Similarityide/hooks/memory-profile-skill.js
HighKnown Malware Source Similarityide/hooks/memory-recall-skill.js
HighKnown Malware Source Similarityide/hooks/memory-remember-skill.js
HighKnown Malware Source Similarityide/hooks/memory-reset-skill.js
HighPrevious Version Dangerous Deltascripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireide/hooks/memory-profile-skill.js
Affected versions and remediation
This report applies to superlocalmemory@4.1.14.
See all versions of superlocalmemory for other recorded verdicts.
- Review the evidence and your use of superlocalmemory@4.1.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.