superlocalmemory@4.2.7
The governed memory brain for AI agents: one local memory for Claude Code, Codex, Cursor, Copilot, ChatGPT and any MCP client. Honest recall, documents and pictures, roles, audit and GDPR erasure.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe postinstall prepares an isolated Python runtime, and the reviewed hooks expose user-invoked memory commands with confirmation for sensitive operations. The flagged source similarity and dynamic-require signals did not establish malicious behavior in the inspected files.
Decision evidence
public snapshot- The manifest runs scripts/postinstall.js during installation, and the installer creates its Python environment inside the package directory.
- The list and recall wrappers invoke the Python CLI with command arguments when run.
- The remember wrapper invokes the Python CLI with command arguments; profile switching asks for confirmation first.
- The soft reset asks for confirmation before invoking the reset command.
- The media feature request requires a flag, environment setting, npm option, or affirmative interactive response.
Source & flagged code
10 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
Affected versions and remediation
This report applies to superlocalmemory@4.2.7.
See all versions of superlocalmemory for other recorded verdicts.
- Review the evidence and your use of superlocalmemory@4.2.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.