← Home

@memohai/desktop

npm Repository Homepage

Memoh Electron desktop application (self-managed bootstrap reusing @memohai/web components)

6
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

acbox.liu

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:@memohai/ui AI (phantom-deps): Same-org sibling dep, likely re-exported through @memohai/web; stable FP. ai
phantom-deps phantom-dep:@memohai/sdk AI (phantom-deps): Same-org sibling dep, likely consumed transitively; stable FP. ai
phantom-deps phantom-dep:@memohai/icon AI (phantom-deps): Same-org sibling dep, likely consumed transitively; stable FP. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IP is 127.0.0.1 (localhost) for a local server — not an external exfiltration endpoint. ai
semgrep semgrep:env-spread AI (semgrep): env-spread is in a build script (scripts/build.mjs), not runtime code; standard pattern for passing env to child build processes. ai
semgrep semgrep:silent-process-exec AI (semgrep): Detached spawn is for a local background server (Qdrant/GStreamer); expected pattern for Electron desktop apps. ai
semgrep semgrep:silent-process-exec-var AI (semgrep): Same spawn call as silent-process-exec; local server management, not malicious. ai

Versions (showing 6 of 6)

Version Deps Published
0.9.0 2 / 30
0.8.3 2 / 32
0.8.2 2 / 32
0.8.1 2 / 32
0.8.0 6 / 24
0.7.3 6 / 24

v0.9.0

11 findings
HIGH env-spread: scripts/build.mjs:63 semgrep

Spreading entire process.env into an object — may capture all secrets 61 | cwd: desktopRoot, 62 | stdio: 'inherit', > 63 | env: { 64 | ...process.env, 65 | ...extraEnv,

HIGH env-spread: scripts/install-icon-tools.mjs:12 semgrep

Spreading entire process.env into an object — may capture all secrets 10 | const child = spawn(pnpm, ['install', '--ignore-workspace'], { 11 | cwd: iconToolsDir, > 12 | env: { 13 | ...process.env, 14 | SHARP_IGNORE_GLOBAL_LIBVIPS: '1',

HIGH env-spread: scripts/prepare-gstreamer.mjs:744 semgrep

Spreading entire process.env into an object — may capture all secrets 742 | 743 | function runtimeEnv(targetDir, spec) { > 744 | return { 745 | ...process.env, 746 | PATH: `${resolve(targetDir, 'bin')}${process.platform === 'win32' ? ';' : ':'}${process.env.PATH ?? ''}`,

HIGH env-spread: scripts/prepare-local-server.mjs:51 semgrep

Spreading entire process.env into an object — may capture all secrets 49 | cwd: repoRoot, 50 | stdio: 'inherit', > 51 | env: { 52 | ...process.env, 53 | ...env,

HIGH env-spread: scripts/prepare-qdrant.mjs:119 semgrep

Spreading entire process.env into an object — may capture all secrets 117 | ], { 118 | stdio: 'inherit', > 119 | env: { 120 | ...process.env, 121 | MEMOH_QDRANT_ARCHIVE: archivePath,

HIGH env-spread: src/main/local-server.ts:348 semgrep

Spreading entire process.env into an object — may capture all secrets 346 | cwd: root, 347 | stdio: 'inherit', > 348 | env: { 349 | ...process.env, 350 | GOOS: 'linux',

HIGH silent-process-exec: src/main/local-server.ts:440 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 438 | } 439 | runMigrations(command) > 440 | const child = spawn(command.command, command.args, { 441 | cwd: command.cwd, 442 | detached: true,

HIGH silent-process-exec-var: src/main/local-server.ts:440 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 438 | } 439 | runMigrations(command) > 440 | const child = spawn(command.command, command.args, { 441 | cwd: command.cwd, 442 | detached: true,

HIGH env-spread: src/main/local-server.ts:505 semgrep

Spreading entire process.env into an object — may capture all secrets 503 | 504 | function serverEnv(command: { configPath: string }): NodeJS.ProcessEnv { > 505 | return { 506 | ...process.env, 507 | ...bundledGStreamerEnv(),

HIGH env-spread: src/main/qdrant.ts:255 semgrep

Spreading entire process.env into an object — may capture all secrets 253 | stdio: ['ignore', logFd, logFd], 254 | windowsHide: process.platform === 'win32', > 255 | env: { 256 | ...process.env, 257 | QDRANT__TELEMETRY_DISABLED: 'true',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.2

10 findings
HIGH env-spread: scripts/build.mjs:63 semgrep

Spreading entire process.env into an object — may capture all secrets 61 | cwd: desktopRoot, 62 | stdio: 'inherit', > 63 | env: { 64 | ...process.env, 65 | ...extraEnv,

HIGH env-spread: scripts/prepare-gstreamer.mjs:524 semgrep

Spreading entire process.env into an object — may capture all secrets 522 | 523 | function runtimeEnv(targetDir, spec) { > 524 | return { 525 | ...process.env, 526 | PATH: `${resolve(targetDir, 'bin')}${process.platform === 'win32' ? ';' : ':'}${process.env.PATH ?? ''}`,

HIGH env-spread: scripts/prepare-local-server.mjs:29 semgrep

Spreading entire process.env into an object — may capture all secrets 27 | cwd: repoRoot, 28 | stdio: 'inherit', > 29 | env: { 30 | ...process.env, 31 | ...env,

HIGH env-spread: scripts/prepare-qdrant.mjs:119 semgrep

Spreading entire process.env into an object — may capture all secrets 117 | ], { 118 | stdio: 'inherit', > 119 | env: { 120 | ...process.env, 121 | MEMOH_QDRANT_ARCHIVE: archivePath,

HIGH env-spread: src/main/local-server.ts:246 semgrep

Spreading entire process.env into an object — may capture all secrets 244 | cwd: root, 245 | stdio: 'inherit', > 246 | env: { 247 | ...process.env, 248 | GOOS: 'linux',

HIGH silent-process-exec: src/main/local-server.ts:338 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 336 | } 337 | runMigrations(command) > 338 | const child = spawn(command.command, command.args, { 339 | cwd: command.cwd, 340 | detached: true,

HIGH silent-process-exec-var: src/main/local-server.ts:338 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 336 | } 337 | runMigrations(command) > 338 | const child = spawn(command.command, command.args, { 339 | cwd: command.cwd, 340 | detached: true,

HIGH env-spread: src/main/local-server.ts:401 semgrep

Spreading entire process.env into an object — may capture all secrets 399 | 400 | function serverEnv(command: { configPath: string }): NodeJS.ProcessEnv { > 401 | return { 402 | ...process.env, 403 | ...bundledGStreamerEnv(),

HIGH env-spread: src/main/qdrant.ts:254 semgrep

Spreading entire process.env into an object — may capture all secrets 252 | detached: true, 253 | stdio: ['ignore', logFd, logFd], > 254 | env: { 255 | ...process.env, 256 | QDRANT__TELEMETRY_DISABLED: 'true',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.