registry / window-memory / 0.3.15

window-memory@0.3.15

Keeps your AI on your goal across Claude Code, Cursor & Codex — session catch-up, why behind every decision, drift alerts. Local-first: free on your machine; Pro syncs across devices and team.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 38 file(s), 258 KB of source, external domains: 127.0.0.1, api.openai.com, app.windowmemory.com, generativelanguage.googleapis.com, orgtibbsxfhncizalstg.supabase.co, windowmemory.com, windowmemory.vercel.app, www.apple.com, www.windowmemory.com

Source & flagged code

7 flagged

dist/cloud-config.jsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.SUPABASE_ANON_KEY=exports.SUPABASE_URL=void 0;const A="https://orgtibbsxfhncizalstg.supabase.co",e="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im9yZ3RpYmJzeGZobmNpemFsc3RnIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Nzg3Mzc1NjcsImV4cCI6MjA5NDMxMzU2N30.b31J5fTdLH6110RXXMkI7-r3UsVa0jVQrAnfYvYGLxw";exports.SUPABASE_URL=(process.env.SUPABASE_URL||A).replace(/\/$/,""),exports.SUPABASE_ANON_KEY=process.env.SUPABASE_ANON_KEY||e;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cloud-config.jsView on unpkg · L1

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cloud-config.js

dist/cloud-config.jsView on unpkg · L1

dist/node-runtime.jsView file

Lines 1-3javascript

dist/security.jsView file

Lines 1-2javascript

1"use strict";var c=exports&&exports.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.maskSecrets=g,exports.safeForLog=u,exports.encryptString=

dist/autostart.jsView file

Lines 1-21javascript

1"use strict";var p=exports&&exports.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var i=Object.getOwnPropertyDescriptor(t,n);(!i||("get"in

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var ze=exports&&exports.__createBinding||(Object.create?(function(e,t,n,o){o===void 0&&(o=n);var r=Object.getOwnPropertyDescriptor(t,n);(!r

dist/cursor-hook-bridge.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Cursor hook bridge: read hook JSON before dist/index.js loads (better-sqlite3 cold start).

4 * Pass payload via WM_HOOK_STDIN + spawnSync stdin so check-reversal gets prompt + workspace_roots.

5 */

6import fs from 'node:fs';

7import os from 'node:os';

8import path from 'node:path';

Source & flagged code

7 flagged · loading source

dist/cloud-config.jsView file

1patternName = supabase_service_key severity = critical line = 1 matchedText = "use str...||e;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cloud-config.jsView on unpkg · L1

1patternName = supabase_service_key severity = critical line = 1 matchedText = "use str...||e;

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cloud-config.js

dist/cloud-config.jsView on unpkg · L1

dist/node-runtime.jsView file

1"use strict";var f=exports&&exports.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.getCliEntryPat... L2: `)[0],actualAbi:s?Number(s[1]):void 0,expectedAbi:s?Number(s[2]):void 0}}}function y(e){try{return d(e)}catch{return null}}function g(){const e=new Set,t=[],r=n=>{if(!n)return;cons...

High

Child Process

Package source references child process execution.

dist/node-runtime.jsView on unpkg · L1

dist/security.jsView file

1"use strict";var c=exports&&exports.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.maskSecrets=g,...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/security.jsView on unpkg · L1

dist/autostart.jsView file

1"use strict";var p=exports&&exports.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var i=Object.getOwnPropertyDescriptor(t,n);(!i||("get"in i?!t.__esModule:i.... L2: sh.Run "cmd /c ""`+(0,l.getNodeRuntime)().execPath.replace(/\\/g,"\\\\")+'"" ""'+d().replace(/\\/g,"\\\\")+`"" start", 0, False\r ... L12: </dict></plist> L13: `;o.mkdirSync(s.dirname(e),{recursive:!0}),o.writeFileSync(e,r,"utf8");try{(0,c.execFileSync)("launchctl",["unload",e],{stdio:"ignore"})}catch{}return(0,c.execFileSync)("launchctl"... L14: Description=Window Memory daemon ... L22: WantedBy=default.target L23: `;o.mkdirSync(s.dirname(e),{recursive:!0}),o.writeFileSync(e,r,"utf8");try{(0,c.execFileSync)("systemctl",["--user","daemon-reload"],{stdio:"ignore"})}catch{}return(0,c.execFileSyn...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart.jsView on unpkg · L1

dist/index.jsView file

1#!/usr/bin/env node L2: "use strict";var ze=exports&&exports.__createBinding||(Object.create?(function(e,t,n,o){o===void 0&&(o=n);var r=Object.getOwnPropertyDescriptor(t,n);(!r||("get"in r?!t.__esModule:r... L3:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

dist/cursor-hook-bridge.mjsView file

8Cross-file remote execution chain: dist/cursor-hook-bridge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L8: import path from 'node:path'; L9: import { spawnSync } from 'node:child_process'; L10: import { fileURLToPath } from 'node:url'; L11: L12: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L13: ... L26: function readStdinFully() { L27: const fromEnv = process.env.WM_HOOK_STDIN; L28: if (typeof fromEnv === 'string' && fromEnv.trim()) return fromEnv; ... L35: if (n <= 0) break; L36: chunks.push(Buffer.from(buf.subarray(0, n))); L37: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cursor-hook-bridge.mjsView on unpkg · L8

Findings

2 Critical4 High5 Medium6 Low

CriticalCritical Secretdist/cloud-config.js

CriticalSecret Patterndist/cloud-config.js

HighChild Processdist/node-runtime.js

HighShell

HighSame File Env Network Executiondist/index.js

HighCross File Remote Execution Contextdist/cursor-hook-bridge.mjs

MediumDynamic Requiredist/security.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/autostart.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/cloud-config.jsView file

Lines 1-2javascript

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cloud-config.jsView on unpkg · L1

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cloud-config.js

dist/cloud-config.jsView on unpkg · L1

dist/node-runtime.jsView file

Lines 1-3javascript

dist/security.jsView file

Lines 1-2javascript

dist/autostart.jsView file

Lines 1-21javascript

1"use strict";var p=exports&&exports.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var i=Object.getOwnPropertyDescriptor(t,n);(!i||("get"in

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var ze=exports&&exports.__createBinding||(Object.create?(function(e,t,n,o){o===void 0&&(o=n);var r=Object.getOwnPropertyDescriptor(t,n);(!r

dist/cursor-hook-bridge.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Cursor hook bridge: read hook JSON before dist/index.js loads (better-sqlite3 cold start).

4 * Pass payload via WM_HOOK_STDIN + spawnSync stdin so check-reversal gets prompt + workspace_roots.

5 */

6import fs from 'node:fs';

7import os from 'node:os';

8import path from 'node:path';