registry  /  toon-memory  /  1.6.4

toon-memory@1.6.4

Persistent memory system for AI coding agents using TOON format (40% fewer tokens than JSON)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 9 file(s), 1.11 MB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

6 flagged · loading source
bin/toon-memory.jsView file
3import { fileURLToPath } from "url"; L4: import { spawn } from "child_process"; L5: const __dirname = dirname(fileURLToPath(import.meta.url));
High
Child Process

Package source references child process execution.

bin/toon-memory.jsView on unpkg · L3
3Cross-file remote execution chain: bin/toon-memory.js spawns mcp/server.js; helper contains network access plus dynamic code execution. L3: import { fileURLToPath } from "url"; L4: import { spawn } from "child_process"; L5: const __dirname = dirname(fileURLToPath(import.meta.url)); L6: const args = process.argv.slice(2);
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/toon-memory.jsView on unpkg · L3
mcp/server.jsView file
17095if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L17096: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L17097: this.scope.value(validateName, { ref: validate });
Low
Eval

Package source references a known benign dynamic code generation pattern.

mcp/server.jsView on unpkg · L17095
dist/cli/setup.jsView file
15console.log("Installing @toon-format/toon..."); L16: execSync("npm install @toon-format/toon", { cwd: projectRoot, stdio: "inherit" }); L17: }
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/setup.jsView on unpkg · L15
12try { L13: createRequire(import.meta.url).resolve("@toon-format/toon"); L14: } catch {
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/setup.jsView on unpkg · L12
uninstall.shView file
•path = uninstall.sh kind = build_helper sizeBytes = 3247 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

Findings

4 High4 Medium6 Low
HighChild Processbin/toon-memory.js
HighShell
HighCross File Remote Execution Contextbin/toon-memory.js
HighRuntime Package Installdist/cli/setup.js
MediumDynamic Requiredist/cli/setup.js
MediumEnvironment Vars
MediumShips Build Helperuninstall.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalmcp/server.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings