registry  /  window-memory  /  0.3.11

window-memory@0.3.11

Keeps your AI on your goal across Claude Code, Cursor & Codex — session catch-up, why behind every decision, drift alerts. Local-first: free on your machine; Pro syncs across devices and team.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 35 file(s), 358 KB of source, external domains: 127.0.0.1, api.openai.com, app.windowmemory.com, generativelanguage.googleapis.com, orgtibbsxfhncizalstg.supabase.co, windowmemory.com, windowmemory.vercel.app, www.apple.com, www.windowmemory.com

Source & flagged code

4 flagged · loading source
dist/cloud-config.jsView file
5patternName = supabase_service_key severity = critical line = 5 matchedText = const DE...xw';
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/cloud-config.jsView on unpkg · L5
5patternName = supabase_service_key severity = critical line = 5 matchedText = const DE...xw';
Critical
Secret Pattern

Supabase service role key (JWT) in dist/cloud-config.js

dist/cloud-config.jsView on unpkg · L5
dist/security.jsView file
9exports.decryptString = decryptString; L10: const node_crypto_1 = __importDefault(require("node:crypto")); L11: const REDACTION_PATTERNS = [
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/security.jsView on unpkg · L9
dist/autostart.jsView file
40const path = __importStar(require("path")); L41: const node_child_process_1 = require("node:child_process"); L42: const node_runtime_1 = require("./node-runtime"); L43: function daemonEntry() { L44: return path.join(__dirname, 'index.js'); L45: } ... L83: try { L84: (0, node_child_process_1.execFileSync)('launchctl', ['unload', plist], { stdio: 'ignore' }); L85: } ... L100: function linuxUnitPath() { L101: const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'); L102: return path.join(base, 'systemd', 'user', 'window-memory.service');
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart.jsView on unpkg · L40

Findings

2 Critical5 Medium6 Low
CriticalCritical Secretdist/cloud-config.js
CriticalSecret Patterndist/cloud-config.js
MediumDynamic Requiredist/security.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/autostart.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License