@remnic/core
14
Versions
—
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
joshuaswarren
Keywords
remnicmemoryaiagentcore
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding used for cryptographic envelope verification, not payload hiding. | ai | |
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Fires in test file using /etc/passwd as a path-traversal test vector, not real credential harvesting. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard Gmail API email body decoding; not obfuscation. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): All instances are localhost (127.0.0.1) URLs in test files — not exfiltration. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env spread passes environment to a child build process (node-gyp); not exfiltration. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall builds better-sqlite3 native module via node-gyp; standard pattern for this dependency. | ai | |
| phantom-deps | phantom-dep:node-gyp | AI (phantom-deps): node-gyp is an implicit build-time dependency invoked by better-sqlite3; not directly imported. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped package @remnic/core is the core module of the Remnic project, not a typosquat of cors. | ai | |
| phantom-deps | phantom-dep:@node-rs/argon2 | AI (phantom-deps): Likely used for optional trust-zone/auth features; phantom-dep heuristic not reliable here. | ai | |
| phantom-deps | phantom-dep:@honcho-ai/sdk | AI (phantom-deps): May be used conditionally or via config; consistent with an AI memory framework pattern. | ai | |
| phantom-deps | phantom-dep:apache-arrow | AI (phantom-deps): apache-arrow is a transitive/peer dep of @lancedb/lancedb; declared but may not be directly imported. | ai |