superlocalmemory@4.2.10
The governed memory brain for AI agents: one local memory for Claude Code, Codex, Cursor, Copilot, ChatGPT and any MCP client. Honest recall, documents and pictures, roles, audit and GDPR erasure.
AI Security Review
scanned 5d ago · by lpm-firewall-aiSource inspection found package-aligned runtime setup and user-invoked memory commands, with confirmation for destructive profile and reset operations. The scanner similarity and dynamic-require hints did not establish harmful behavior in the required source files.
Decision evidence
public snapshot- package.json runs a postinstall script and declares no runtime dependencies beyond docx.
- Postinstall creates a package-local Python virtual environment and installs the package into it.
- The media setup step asks before recording a request and uses a default-no prompt when interactive.
- Memory list and recall commands pass their supplied arguments to the corresponding product CLI commands.
- Profile and remember hooks call the product CLI; profile deletion and switching require confirmation.
- Reset operations are user-invoked, warn before changes, and require confirmation for destructive actions.
Source & flagged code
10 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
Affected versions and remediation
This report applies to superlocalmemory@4.2.10.
See all versions of superlocalmemory for other recorded verdicts.
- Review the evidence and your use of superlocalmemory@4.2.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.