superlocalmemory@4.2.3
The governed memory brain for AI agents: one local memory for Claude Code, Codex, Cursor, Copilot, ChatGPT and any MCP client. Honest recall, documents and pictures, roles, audit and GDPR erasure.
AI Security Review
scanned 9d ago · by lpm-firewall-aiInspected source shows package-local runtime setup and user-directed local CLI operations. Optional media setup requires an affirmative choice, and no concrete attack behavior was found in the required flagged files.
Decision evidence
public snapshot- The manifest’s install hooks invoke the package installer and pre-uninstall notice; its listed runtime dependency is docx.
- The installer creates a Python virtual environment inside the package and installs the selected package source into that environment.
- The optional media setup asks for consent in an interactive terminal and records a request only when enabled.
- The list, recall, and remember hooks pass their respective user-supplied commands to the local SuperLocalMemory CLI.
- The profile hook passes profile commands to the local CLI and includes confirmation prompts for profile changes.
- The reset hook requires explicit confirmation before a hard reset.
Source & flagged code
11 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
Affected versions and remediation
This report applies to superlocalmemory@4.2.3.
See all versions of superlocalmemory for other recorded verdicts.
- Review the evidence and your use of superlocalmemory@4.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.