registry / window-memory / 0.3.15

window-memory@0.3.15

Keeps your AI on your goal across Claude Code, Cursor & Codex — session catch-up, why behind every decision, drift alerts. Local-first: free on your machine; Pro syncs across devices and team.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 38 file(s), 258 KB of source, external domains: 127.0.0.1, api.openai.com, app.windowmemory.com, generativelanguage.googleapis.com, orgtibbsxfhncizalstg.supabase.co, windowmemory.com, windowmemory.vercel.app, www.apple.com, www.windowmemory.com

Source & flagged code

7 flagged

dist/cloud-config.jsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.SUPABASE_ANON_KEY=exports.SUPABASE_URL=void 0;const A="https://orgtibbsxfhncizalstg.supabase.co",e="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im9yZ3RpYmJzeGZobmNpemFsc3RnIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Nzg3Mzc1NjcsImV4cCI6MjA5NDMxMzU2N30.b31J5fTdLH6110RXXMkI7-r3UsVa0jVQrAnfYvYGLxw"

Source & flagged code

7 flagged · loading source

dist/cloud-config.jsView file

1patternName = supabase_service_key severity = critical line = 1 matchedText = "use str...||e;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cloud-config.jsView on unpkg · L1

1patternName = supabase_service_key severity = critical line = 1 matchedText = "use str...||e;

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cloud-config.js

dist/cloud-config.jsView on unpkg · L1

dist/node-runtime.jsView file

1"use strict";var f=exports&&exports.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.getCliEntryPat... L2: `)[0],actualAbi:s?Number(s[1]):void 0,expectedAbi:s?Number(s[2]):void 0}}}function y(e){try{return d(e)}catch{return null}}function g(){const e=new Set,t=[],r=n=>{if(!n)return;cons...

High

Child Process

Package source references child process execution.

dist/node-runtime.jsView on unpkg · L1

dist/security.jsView file

1"use strict";var c=exports&&exports.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.maskSecrets=g,...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/security.jsView on unpkg · L1

dist/autostart.jsView file

1"use strict";var p=exports&&exports.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var i=Object.getOwnPropertyDescriptor(t,n);(!i||("get"in i?!t.__esModule:i.... L2: sh.Run "cmd /c ""`+(0,l.getNodeRuntime)().execPath.replace(/\\/g,"\\\\")+'"" ""'+d().replace(/\\/g,"\\\\")+`"" start", 0, False\r ... L12: </dict></plist> L13: `;o.mkdirSync(s.dirname(e),{recursive:!0}),o.writeFileSync(e,r,"utf8");try{(0,c.execFileSync)("launchctl",["unload",e],{stdio:"ignore"})}catch{}return(0,c.execFileSync)("launchctl"... L14: Description=Window Memory daemon ... L22: WantedBy=default.target L23: `;o.mkdirSync(s.dirname(e),{recursive:!0}),o.writeFileSync(e,r,"utf8");try{(0,c.execFileSync)("systemctl",["--user","daemon-reload"],{stdio:"ignore"})}catch{}return(0,c.execFileSyn...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart.jsView on unpkg · L1

dist/index.jsView file

1#!/usr/bin/env node L2: "use strict";var ze=exports&&exports.__createBinding||(Object.create?(function(e,t,n,o){o===void 0&&(o=n);var r=Object.getOwnPropertyDescriptor(t,n);(!r||("get"in r?!t.__esModule:r... L3:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

dist/cursor-hook-bridge.mjsView file

8Cross-file remote execution chain: dist/cursor-hook-bridge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L8: import path from 'node:path'; L9: import { spawnSync } from 'node:child_process'; L10: import { fileURLToPath } from 'node:url'; L11: L12: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L13: ... L26: function readStdinFully() { L27: const fromEnv = process.env.WM_HOOK_STDIN; L28: if (typeof fromEnv === 'string' && fromEnv.trim()) return fromEnv; ... L35: if (n <= 0) break; L36: chunks.push(Buffer.from(buf.subarray(0, n))); L37: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cursor-hook-bridge.mjsView on unpkg · L8

Findings

2 Critical4 High5 Medium6 Low

CriticalCritical Secretdist/cloud-config.js

CriticalSecret Patterndist/cloud-config.js

HighChild Processdist/node-runtime.js

HighShell

HighSame File Env Network Executiondist/index.js

HighCross File Remote Execution Contextdist/cursor-hook-bridge.mjs

MediumDynamic Requiredist/security.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/autostart.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

dist/node-runtime.jsView file

Lines 1-3javascript

1"use strict";var f=exports&&exports.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.getCliEntryPath=i,exports.getNodeRuntime=d,exports.buildMcpLaunchEntry=v,exports.buildDirectNodeCommand=x,exports.getCursorHookBridgePath=p,exports.buildCursorHookCommand=C,exports.mcpEntryNeedsRefresh=N,exports.getPackageRoot=c,exports.checkBetterSqlite3=h,exports.probeNodeAt=y,exports.discoverNodeCandidates=g,exports.formatNodeDoctorLines=_;const u=f(require("node:fs")),o=f(require("node:path")),m=require("node:child_process");f ...

2`)[0],actualAbi:s?Number(s[1]):void 0,expectedAbi:s?Number(s[2]):void 0}}}function y(e){try{return d(e)}catch{return null}}function g(){const e=new Set,t=[],r=n=>{if(!n)return;const s=o.default.resolve(n);e.has(s.toLowerCase())||u.default.existsSync(s)&&(e.add(s.toLowerCase()),t.push(d(s)))};if(r(process.execPath),process.platform==="win32"){r(o.default.join(process.env.ProgramFiles??"","nodejs","node.exe"));const n=process.env.LOCALAPPDATA??"";r(o.default.join(n,"Programs","cursor","resources","app","resources","helpers","node.exe"))}return t}function _(){const e=[],t=d(),r=h();e.push("## Nod ...

High

Child Process

Package source references child process execution.

dist/node-runtime.jsView on unpkg · L1

Long lines were clipped for display.

dist/autostart.jsView file

Lines 1-21javascript

1"use strict";var p=exports&&exports.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var i=Object.getOwnPropertyDescriptor(t,n);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,i)}):(function(e,t,n,r){r===void 0&&(r=n),e[r]=t[n]})),h=exports&&exports.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),a=exports&&exports.__importStar||(function(){var e=function(t){return e=Object.getOwnPropertyNames||funct ...

2sh.Run "cmd /c ""`+(0,l.getNodeRuntime)().execPath.replace(/\\/g,"\\\\")+'"" ""'+d().replace(/\\/g,"\\\\")+`"" start", 0, False\r

3`;return o.mkdirSync(s.dirname(e),{recursive:!0}),o.writeFileSync(e,n,"utf8"),{ok:!0,method:"startup-folder",path:e}}function w(){const e=f();return o.existsSync(e)&&o.rmSync(e,{force:!0}),{ok:!0,method:"startup-folder",path:e}}function m(){return s.join(u.homedir(),"Library","LaunchAgents","com.window-memory.daemon.plist")}function b(){const e=m(),t=(0,l.getNodeRuntime)().execPath,n=d(),r=`<?xml version="1.0" encoding="UTF-8"?>

4<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

5<plist version="1.0"><dict>

6 <key>Label</key><string>com.window-memory.daemon</string>

7 <key>ProgramArguments</key><array>

8 <string>`+t+"</string><string>"+n+`</string><string>start</string>

9 </array>

10 <key>RunAtLoad</key><true/>

11 <key>KeepAlive</key><true/>

12</dict></plist>

13`;o.mkdirSync(s.dirname(e),{recursive:!0}),o.writeFileSync(e,r,"utf8");try{(0,c.execFileSync)("launchctl",["unload",e],{stdio:"ignore"})}catch{}return(0,c.execFileSync)("launchctl",["load","-w",e],{stdio:"ignore"}),{ok:!0,method:"launchd",path:e}}function S(){const e=m();try{(0,c.execFileSync)("launchctl",["unload","-w",e],{stdio:"ignore"})}catch{}return o.existsSync(e)&&o.rmSync(e,{force:!0}),{ok:!0,method:"launchd",path:e}}function y(){const e=process.env.XDG_CONFIG_HOME||s.join(u.homedir(),".config");return s.join(e,"systemd","user","window-memory.service")}function _(){const e=y(),t=(0,l.g ...

14Description=Window Memory daemon

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart.jsView on unpkg · L1

15After=network-online.target

17[Service]

18ExecStart=`+t+" "+n+` start

19Restart=on-failure

21[Install]

Long lines were clipped for display.

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var ze=exports&&exports.__createBinding||(Object.create?(function(e,t,n,o){o===void 0&&(o=n);var r=Object.getOwnPropertyDescriptor(t,n);(!r||("get"in r?!t.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,o,r)}):(function(e,t,n,o){o===void 0&&(o=n),e[o]=t[n]})),qe=exports&&exports.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),X=exports&&exports.__importStar||(function(){var e=function(t){return e=Object.getOwnPropertyNames||fun ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

4${b}`:b,s=(b,A)=>{e.client==="cursor"?console.log(JSON.stringify({additional_context:b})):e.client==="codex"?console.log(JSON.stringify({hookSpecificOutput:{hookEventName:"SessionStart",additionalContext:b}})):e.json?console.log(JSON.stringify({...A},null,2)):console.log(JSON.stringify({hookSpecificOutput:{hookEventName:"SessionStart",additionalContext:b}}))},u=await(0,T.getBillingState)().catch(()=>null),m=u!=null&&!u.cloud_sync_allowed,d=m?(0,S.liveFreeProjectId)():null,f=!!((0,C.getGoogleKey)()||(0,C.getAnthropicKey)()||(0,C.getOpenAIKey)())||!!(u&&u.cloud_sync_allowed)?"ok":(0,C.hasSupabas ...

5`);s(c(A),{matched:!1,free_limited:!0});return}if(f!=="ok"){const A=h();s(c(A),{matched:!1,capture_gate:f,message:A});return}const b=(0,W.buildReadyFirstSessionMessage)();s(c(b),{matched:!1,capture_gate:"ok",message:b});

6`);s(c(b),{matched:!0,project_id:o.project_id,locked:!0});return}if(f!=="ok"){if((0,j.recentEvents)(o.project_id,1).length===0){const N=h();s(c(N),{matched:!0,project_id:o.project_id,capture_gate:f,message:N});return}const A=await(0,ee.buildTimelineSummaryWithCloud)(o.project_id),G=[h(),"",

7`);s(c(G),{matched:!0,project_id:o.project_id,capture_gate:f,...A});return}const l=await(0,ee.buildTimelineSummaryWithCloud)(o.project_id),k=["[window-memory] Auto-injected Window Memory catch-up. Open your reply to the user by",'surfacing this \u2014 lead with a line like "[window-memory] Last time you \u2026" (use the summary',"below) so the user can SEE Window Memory is active \u2014 then continue answering normally."].join(" "),R=[],$=(0,j.latestDirection)(o.project_id,1)[0

8`);s(c(x),{matched:!0,project_id:o.project_id,...l})}catch(t){_("[recall]",t.message),process.exit(1)}});function z(e){const t=(0,S.listProjects)(),n=(0,v.normalizePath)(e),o=t.find(u=>u.path&&!u.path.startsWith("(")&&(0,v.normalizePath)(u.path)===n);if(o)return o;const r=mt(e);if(r){const u=t.find(m=>m.git_remote===r);if(u)return u}const c=(0,v.detectProject)(e),s=t.find(u=>u.project_id===c.project_id);return s||null}function ce(e){const t=z(e);if(t)return t;const n=(0,v.detectProject)(e);return(0,S.listProjects)().find(o=>o.project_id===n.project_id)??null}function le(e){const t=[];if(Array. ...

9`)}catch{}}function Ee(e){const t=e.match(/<user_query>\s*([\s\S]*?)\s*<\/user_query>/i);return t?.[1]?t[1].trim():e.replace(/<timestamp>[\s\S]*?<\/timestamp>\s*/

10`).filter(o=>o.trim());for(let o=n.length-1;o>=0;o--)try{const r=JSON.parse(n[o]);if(r.role!=="user"||!r.message?.content)continue;const c=r.message.content;if(typeof c

11`),u=Ee(s);if(u.length>=3)return u}}catch{continue}return""}function dt(){const e=y.join(U.homedir(),".cursor","projects");if(!w.existsSync(e))return null;const

12`),process.exit(2)});function kt(e){const t=e.tool_name??"",n=typeof e.tool_input=="object"&&e.tool_input!==null?e.tool_input:{},o=ue(e),r=(0,D.peekReversalBlock)({sessionIds:_t(e),workspaceRoot:q(e),generationId:e.generation_id,conversationId:e.conversation_id});if(r)return{skip:!1,reminder:r.message,dedupKey:`reversal::${r.eventId}`,deny:!0};const c=(0,ne.readManagedAlert)();if(c&&o&&!pe(o,c.bucket))return Z(o,c.bucket),{skip:!1,reminder:c.line};const s=t==="TodoWrite"||t==="update_plan",u=t==="Agent"||t==="Task",m=t==="Write"||t==="apply_patch",d=t==="Bash"||t==="shell",a=t==="Edit"||t==="M ...

13Paste any known past failures/decisions into the subagent prompt yourself. Do not assume the child inherits parent memory.`,St=`[window-memory] About to draft a TODO list.

14SELF-CHECK FIRST: Call mcp__window-memory__search_events with 2-3 core nouns from the user's request.

15If past work in the same area shows failures, reversals, or rule decisions, reflect them in the TODOs

16so you don't repeat the same wrong path. This is the cheap step that prevents the expensive reversal.`,bt=`[window-memory] Writing a large new file.

17SELF-CHECK FIRST: Call mcp__window-memory__search_events on the file's domain (e.g. "auth", "watcher",

18"i18n", "cloud sync"). Past code may have set conventions, naming patterns, or had specific failures

19worth respecting.`,$t=`[window-memory] About to run an irreversible shell command

20(delete / force-push / publish / drop / truncate).

21SELF-CHECK FIRST: Call mcp__window-memory__search_events on the action verb (e.g. "publish",

Long lines were clipped for display.