registry / superlocalmemory / 4.1.15
superlocalmemory@4.1.15
Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a remote runtime-loader and a first-party agent plugin with automatic hooks, so its effective behavior cannot be fully verified from this npm snapshot. Its lifecycle code does not establish the concrete malicious chain required for a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm installation, or a session using the included Claude plugin.
Impact
The uninspectable Python payload executes in the installer or agent environment and receives agent lifecycle events.
Mechanism
Lifecycle-installed remote Python payload and agent lifecycle hooks.
AI rationale
The package contains a remote runtime-loader and a first-party agent plugin with automatic hooks, so its effective behavior cannot be fully verified from this npm snapshot. Its lifecycle code does not establish the concrete malicious chain required for a publish block.
Evidence
scripts/postinstall.jsplugin/hooks/hooks.jsonplugin/scripts/ensure-venv.shplugin/requirements.txt.slm-venv
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The npm postinstall hook runs automatically.
- Postinstall creates a private virtual environment and uses pip to install a separately fetched Python package of the same name and version.
- The included first-party Claude plugin starts commands on session start and after prompts and tool use.
- The plugin bootstrap installs the pinned Python package into persistent plugin storage.
Evidence against
- The npm lifecycle code only targets its package-owned virtual environment and does not write host agent configuration.
- No credential harvesting or external exfiltration endpoint is present in the inspected shipped source.
- IDE configuration files are templates; postinstall does not install them.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgide/hooks/memory-profile-skill.jsView file
•matchType = normalized_sha256
matchedPackage = superlocalmemory@3.6.23
matchedPath = ide/hooks/memory-profile-skill.js
matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
7 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedscripts/postinstall-interactive.js#virtual:normalized:round1
HighKnown Malware Source Similarityide/hooks/memory-list-skill.js
HighKnown Malware Source Similarityide/hooks/memory-profile-skill.js
HighKnown Malware Source Similarityide/hooks/memory-recall-skill.js
HighKnown Malware Source Similarityide/hooks/memory-remember-skill.js
HighKnown Malware Source Similarityide/hooks/memory-reset-skill.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireide/hooks/memory-profile-skill.js
MediumEnvironment Vars
MediumShips Build Helperide/completions/slm.zsh
Affected versions and remediation
This report applies to superlocalmemory@4.1.15.
See all versions of superlocalmemory for other recorded verdicts.
- Review the evidence and your use of superlocalmemory@4.1.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.