registry / yggdrasil-memory / 0.9.1

yggdrasil-memory@0.9.1

Installer/launcher for Yggdrasil — one shared, durable memory for your AI coding agents (MCP, local-first). Bootstraps the Python core via uv, so `npx yggdrasil-memory` works even without a preinstalled Python.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 2.89 KB of source, external domains: astral.sh, docs.astral.sh, pipx.pypa.io

Source & flagged code

1 flagged

bin/ygg.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2'use strict';

4/*

5 * Yggdrasil npm launcher.

6 *

7 * Yggdrasil's engine is pure Python. This package is a thin launcher: it makes

8 * sure a runner is available (prefers `uv`/`uvx`, which can fetch a managed

9 * Python on its own), then runs the published Python package `yggdrasil-memory`

10 * and forwards every argument. So `npx yggdrasil-memory install` works even on

11 * a machine without Python.

12 *

13 * Env overrides:

14 * YGG_NPM_SOURCE install source for uvx/pipx (default: "yggdrasil-memory").

15 * Use a wheel path or "git+https://github.com/VonderVuflya/yggdrasil.git" to test.

16 * YGG_NO_BOOTSTRAP set to "1" to never auto-install uv.

17 */

19const { spawnSync } = require('child_process');

20const os = require('os');

21const path = require('path');

23const SOURCE = process.env.YGG_NPM_SOURCE || 'yggdrasil-memory';

24const args = process.argv.slice(2);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/ygg.jsView on unpkg · L14

26function has(cmd) {

27 const r = spawnSync(cmd, ['--version'], { stdio: 'ignore' });

28 return !r.error && r.status === 0;

29}

31function run(cmd, cmdArgs) {

32 const r = spawnSync(cmd, cmdArgs, { stdio: 'inherit' });

33 if (r.error) return null;

34 return r.status === null ? 1 : r.status;

Source & flagged code

1 flagged · loading source

bin/ygg.jsView file

14* YGG_NPM_SOURCE install source for uvx/pipx (default: "yggdrasil-memory"). L15: * Use a wheel path or "git+https://github.com/VonderVuflya/yggdrasil.git" to test. L16: * YGG_NO_BOOTSTRAP set to "1" to never auto-install uv. ... L18: L19: const { spawnSync } = require('child_process'); L20: const os = require('os'); ... L22: L23: const SOURCE = process.env.YGG_NPM_SOURCE || 'yggdrasil-memory'; L24: const args = process.argv.slice(2); ... L38: if (process.env.YGG_NO_BOOTSTRAP === '1') return false; L39: process.stderr.write( L40: 'yggdrasil: uv not found — installing it once via https://astral.sh/uv ...\n'

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/ygg.jsView on unpkg · L14

Findings

1 High1 Medium2 Low

HighSandbox Evasion Gated Capabilitybin/ygg.js

MediumEnvironment Vars

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

bin/ygg.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2'use strict';

4/*

5 * Yggdrasil npm launcher.

6 *

7 * Yggdrasil's engine is pure Python. This package is a thin launcher: it makes

8 * sure a runner is available (prefers `uv`/`uvx`, which can fetch a managed

9 * Python on its own), then runs the published Python package `yggdrasil-memory`

10 * and forwards every argument. So `npx yggdrasil-memory install` works even on

11 * a machine without Python.

12 *

13 * Env overrides:

14 * YGG_NPM_SOURCE install source for uvx/pipx (default: "yggdrasil-memory").

15 * Use a wheel path or "git+https://github.com/VonderVuflya/yggdrasil.git" to test.

16 * YGG_NO_BOOTSTRAP set to "1" to never auto-install uv.

17 */

19const { spawnSync } = require('child_process');

20const os = require('os');

21const path = require('path');

23const SOURCE = process.env.YGG_NPM_SOURCE || 'yggdrasil-memory';

24const args = process.argv.slice(2);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/ygg.jsView on unpkg · L14

26function has(cmd) {

27 const r = spawnSync(cmd, ['--version'], { stdio: 'ignore' });

28 return !r.error && r.status === 0;

29}

31function run(cmd, cmdArgs) {

32 const r = spawnSync(cmd, cmdArgs, { stdio: 'inherit' });

33 if (r.error) return null;

34 return r.status === null ? 1 : r.status;