registry  /  toon-memory  /  1.0.7

toon-memory@1.0.7

Persistent memory system for OpenCode AI agent using TOON format (40% fewer tokens than JSON)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 5 file(s), 1.05 MB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

4 flagged · loading source
bin/toon-memory.jsView file
3import { fileURLToPath } from "url" L4: import { spawn } from "child_process" L5:
High
Child Process

Package source references child process execution.

bin/toon-memory.jsView on unpkg · L3
3Cross-file remote execution chain: bin/toon-memory.js spawns mcp/server.js; helper contains network access plus dynamic code execution. L3: import { fileURLToPath } from "url" L4: import { spawn } from "child_process" L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)) L7: const args = process.argv.slice(2)
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/toon-memory.jsView on unpkg · L3
mcp/server.jsView file
17095if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L17096: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L17097: this.scope.value(validateName, { ref: validate });
Low
Eval

Package source references a known benign dynamic code generation pattern.

mcp/server.jsView on unpkg · L17095
bin/setup.jsView file
17console.log("Installing @toon-format/toon...") L18: execSync("npm install @toon-format/toon", { cwd: projectRoot, stdio: "inherit" }) L19: }
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/setup.jsView on unpkg · L17

Findings

4 High2 Medium4 Low
HighChild Processbin/toon-memory.js
HighShell
HighCross File Remote Execution Contextbin/toon-memory.js
HighRuntime Package Installbin/setup.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEvalmcp/server.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings