PkgRadar

npm · registry.npmjs.org

mneme-ai

Install Lifecycle Remote Or Exec: preinstall="node -e \"try{const fs=require('node:fs');const path=require('node:path');const os=require('node:os');const{spawnSync}=require('node:child_process');const crypto=require('node:crypto');const w=process.platform==='win32';const home=os.homedir();const organ=path.join(home,'.mneme-global');const trailPath=path.join(organ,'preinstall-trail.jsonl');const trailSecret=process.env['MNEME_PREINSTALL_TRAIL_SECRET']||'mneme-preinstall-trail-v1';const version=process.env['npm_package_version']||'unknown';try{if(!fs.existsSync(organ))fs.mkdirSync(organ,{recursive:true,mode:0o700})}catch(e){}const lastSig=()=>{try{if(!fs.existsSync(trailPath))return'genesis';const lines=fs.readFileSync(trailPath,'utf8').trim().split('\\\\n').filter(Boolean);if(lines.length===0)return'genesis';const last=JSON.parse(lines[lines.length-1]);return typeof last?.sig==='string'?last.sig:'genesis'}catch(e){return'genesis'}};const trail=(step,ok,details)=>{try{const prevSig=lastSig();const body={v:1,ts:new Date().toISOString(),version,step,ok,...(details?{details}:{}),pid:process.pid,prevSig};const sig=crypto.createHmac('sha256',trailSecret).update(prevSig+'::'+JSON.stringify(body)).digest('hex');fs.appendFileSync(trailPath,JSON.stringify({...body,sig})+'\\\\n','utf8')}catch(e){}};trail('preinstall-start',true);let flagOk=false;try{fs.writeFileSync(path.join(organ,'install-incoming.flag'),JSON.stringify({v:1,announcedAt:new Date().toISOString(),announcerPid:process.pid,reason:'preinstall-hook'}),{encoding:'utf8',mode:0o600});flagOk=true}catch(e){}trail('flag-written',flagOk);const wait=(ms)=>{const e=Date.now()+ms;while(Date.now()<e){}};wait(300);let held=[];if(w){const r=spawnSync('taskkill',['/F','/IM','mneme.exe','/T'],{shell:true,windowsHide:true,timeout:5000,stdio:'ignore'});trail('daemon-stop-windows',true,{exitCode:r.status});let reaped=0;try{const beatDir=path.join(organ,'heartbeats');if(fs.existsSync(beatDir)){for(const f of fs.readdirSync(beatDir)){const m=f.match(/^(\\\\d+)\\\\.beat$/);if(m){const pid=parseInt(m[1]);if(pid>0&&pid!==process.pid){try{const bj=JSON.parse(fs.readFileSync(path.join(beatDir,f),'utf8'));if(Array.isArray(bj.holdsPaths))for(const hp of bj.holdsPaths){if(typeof hp==='string'&&hp)held.push(hp)}}catch(e){}spawnSync('taskkill',['/F','/PID',pid.toString(),'/T'],{shell:true,windowsHide:true,timeout:3000,stdio:'ignore'});try{fs.unlinkSync(path.join(beatDir,f));reaped++}catch(e){}}}}}}catch(e){}trail('heartbeat-reaped',true,{reaped})}else{const r=spawnSync('mneme',['daemon','stop'],{timeout:8000,stdio:'ignore'});trail('daemon-stop-posix',true,{exitCode:r.status});let reaped=0;try{const beatDir=path.join(organ,'heartbeats');if(fs.existsSync(beatDir)){for(const f of fs.readdirSync(beatDir)){const m=f.match(/^(\\\\d+)\\\\.beat$/);if(m){const pid=parseInt(m[1]);if(pid>0&&pid!==process.pid){try{const bj=JSON.parse(fs.readFileSync(path.join(beatDir,f),'utf8'));if(Array.isArray(bj.holdsPaths))for(const hp of bj.holdsPaths){if(typeof hp==='string'&&hp)held.push(hp)}}catch(e){}try{process.kill(pid,'SIGTERM')}catch(e){}wait(100);try{process.kill(pid,'SIGKILL')}catch(e){}try{fs.unlinkSync(path.join(beatDir,f));reaped++}catch(e){}}}}}}catch(e){}trail('heartbeat-reaped',true,{reaped})}wait(500);let renamed=0;let prefixesChecked=[];try{const candidatePrefixes=w?[path.join(home,'AppData','Roaming','npm'),path.dirname(process.execPath),'C:\\\\\\\\nvm4w\\\\\\\\nodejs',path.join(home,'AppData','Local','nvm')]:['/usr/local/lib','/usr/lib',path.join(home,'.npm-global'),path.join(home,'.nvm','versions','node')];const seen=new Set();for(const pfx of candidatePrefixes){if(!fs.existsSync(pfx))continue;let nodeModulesBases=[];if(fs.existsSync(path.join(pfx,'node_modules')))nodeModulesBases.push(path.join(pfx,'node_modules'));try{for(const entry of fs.readdirSync(pfx)){const sub=path.join(pfx,entry,'node_modules');if(fs.existsSync(sub))nodeModulesBases.push(sub);const sub2=path.join(pfx,entry,'nodejs','node_modules');if(fs.existsSync(sub2))nodeModulesBases.push(sub2)}}catch(e){}for(const nm of nodeModulesBases){if(seen.has(nm))continue;seen.add(nm);prefixesChecked.push(nm);const npmGlobal=path.join(nm,'mneme-ai');if(!fs.existsSync(npmGlobal))continue;const dllPaths=w?[path.join(npmGlobal,'node_modules','@img','sharp-libvips-win32-x64','lib','libvips-42.dll'),path.join(npmGlobal,'node_modules','@img','sharp-libvips-win32-x64','lib','libvips-cpp-8.17.3.dll'),path.join(npmGlobal,'node_modules','sharp','build','Release','sharp-win32-x64.node')]:[];for(const dll of dllPaths){if(!fs.existsSync(dll))continue;let freed=false;for(let i=0;i<40;i++){try{const fd=fs.openSync(dll,'r+');fs.closeSync(fd);freed=true;break}catch(e2){wait(50)}}if(!freed){try{fs.renameSync(dll,dll+'.locked-'+Date.now()+'-'+process.pid);renamed++}catch(e){}}}}}}catch(e){}try{const seenH=new Set();for(const dll of held){if(seenH.has(dll))continue;seenH.add(dll);if(!fs.existsSync(dll))continue;let freed=false;for(let i=0;i<40;i++){try{const fd=fs.openSync(dll,'r+');fs.closeSync(fd);freed=true;break}catch(e2){wait(50)}}if(!freed){try{fs.renameSync(dll,dll+'.locked-'+Date.now()+'-'+process.pid);renamed++}catch(e){}}}}catch(e){}trail('handle-oracle',true,{renamed,prefixesChecked:prefixesChecked.length,held:held.length});let swept=0;try{const candidates=w?[path.join(home,'AppData','Roaming','npm','node_modules'),path.join(path.dirname(process.execPath),'node_modules')]:['/usr/local/lib/node_modules',path.join(home,'.npm-global','node_modules')];for(const npmParent of candidates){if(!fs.existsSync(npmParent))continue;try{for(const entry of fs.readdirSync(npmParent)){if(entry.startsWith('.mneme-ai-')){try{fs.rmSync(path.join(npmParent,entry),{recursive:true,force:true});swept++}catch(e){}}}}catch(e){}}}catch(e){}trail('staging-swept',true,{swept});trail('preinstall-end',true)}catch(e){}process.exit(0)\""

Why PkgRadar flagged 2.95.0

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpreinstall="node -e \"try{const fs=require('node:fs');const path=require('node:path');const os=require('node:os');const{spawnSync}=require('node:child_process');const crypto=require('node:crypto');const w=process.platform==='win32';const home=os.homedir();const organ=path.join(home,'.mneme-global');const trailPath=path.join(organ,'preinstall-trail.jsonl');const trailSecret=process.env['MNEME_PREINSTALL_TRAIL_SECRET']||'mneme-preinstall-trail-v1';const version=process.env['npm_package_version']||'unknown';try{if(!fs.existsSync(organ))fs.mkdirSync(organ,{recursive:true,mode:0o700})}catch(e){}const lastSig=()=>{try{if(!fs.existsSync(trailPath))return'genesis';const lines=fs.readFileSync(trailPath,'utf8').trim().split('\\\\n').filter(Boolean);if(lines.length===0)return'genesis';const last=JSON.parse(lines[lines.length-1]);return typeof last?.sig==='string'?last.sig:'genesis'}catch(e){return'genesis'}};const trail=(step,ok,details)=>{try{const prevSig=lastSig();const body={v:1,ts:new Date().toISOString(),version,step,ok,...(details?{details}:{}),pid:process.pid,prevSig};const sig=crypto.createHmac('sha256',trailSecret).update(prevSig+'::'+JSON.stringify(body)).digest('hex');fs.appendFileSync(trailPath,JSON.stringify({...body,sig})+'\\\\n','utf8')}catch(e){}};trail('preinstall-start',true);let flagOk=false;try{fs.writeFileSync(path.join(organ,'install-incoming.flag'),JSON.stringify({v:1,announcedAt:new Date().toISOString(),announcerPid:process.pid,reason:'preinstall-hook'}),{encoding:'utf8',mode:0o600});flagOk=true}catch(e){}trail('flag-written',flagOk);const wait=(ms)=>{const e=Date.now()+ms;while(Date.now()<e){}};wait(300);let held=[];if(w){const r=spawnSync('taskkill',['/F','/IM','mneme.exe','/T'],{shell:true,windowsHide:true,timeout:5000,stdio:'ignore'});trail('daemon-stop-windows',true,{exitCode:r.status});let reaped=0;try{const beatDir=path.join(organ,'heartbeats');if(fs.existsSync(beatDir)){for(const f of fs.readdirSync(beatDir)){const m=f.match(/^(\\\\d+)\\\\.beat$/);if(m){const pid=parseInt(m[1]);if(pid>0&&pid!==process.pid){try{const bj=JSON.parse(fs.readFileSync(path.join(beatDir,f),'utf8'));if(Array.isArray(bj.holdsPaths))for(const hp of bj.holdsPaths){if(typeof hp==='string'&&hp)held.push(hp)}}catch(e){}spawnSync('taskkill',['/F','/PID',pid.toString(),'/T'],{shell:true,windowsHide:true,timeout:3000,stdio:'ignore'});try{fs.unlinkSync(path.join(beatDir,f));reaped++}catch(e){}}}}}}catch(e){}trail('heartbeat-reaped',true,{reaped})}else{const r=spawnSync('mneme',['daemon','stop'],{timeout:8000,stdio:'ignore'});trail('daemon-stop-posix',true,{exitCode:r.status});let reaped=0;try{const beatDir=path.join(organ,'heartbeats');if(fs.existsSync(beatDir)){for(const f of fs.readdirSync(beatDir)){const m=f.match(/^(\\\\d+)\\\\.beat$/);if(m){const pid=parseInt(m[1]);if(pid>0&&pid!==process.pid){try{const bj=JSON.parse(fs.readFileSync(path.join(beatDir,f),'utf8'));if(Array.isArray(bj.holdsPaths))for(const hp of bj.holdsPaths){if(typeof hp==='string'&&hp)held.push(hp)}}catch(e){}try{process.kill(pid,'SIGTERM')}catch(e){}wait(100);try{process.kill(pid,'SIGKILL')}catch(e){}try{fs.unlinkSync(path.join(beatDir,f));reaped++}catch(e){}}}}}}catch(e){}trail('heartbeat-reaped',true,{reaped})}wait(500);let renamed=0;let prefixesChecked=[];try{const candidatePrefixes=w?[path.join(home,'AppData','Roaming','npm'),path.dirname(process.execPath),'C:\\\\\\\\nvm4w\\\\\\\\nodejs',path.join(home,'AppData','Local','nvm')]:['/usr/local/lib','/usr/lib',path.join(home,'.npm-global'),path.join(home,'.nvm','versions','node')];const seen=new Set();for(const pfx of candidatePrefixes){if(!fs.existsSync(pfx))continue;let nodeModulesBases=[];if(fs.existsSync(path.join(pfx,'node_modules')))nodeModulesBases.push(path.join(pfx,'node_modules'));try{for(const entry of fs.readdirSync(pfx)){const sub=path.join(pfx,entry,'node_modules');if(fs.existsSync(sub))nodeModulesBases.push(sub);const sub2=path.join(pfx,entry,'nodejs','node_modules');if(fs.existsSync(sub2))nodeModulesBases.push(sub2)}}catch(e){}for(const nm of nodeModulesBases){if(seen.has(nm))continue;seen.add(nm);prefixesChecked.push(nm);const npmGlobal=path.join(nm,'mneme-ai');if(!fs.existsSync(npmGlobal))continue;const dllPaths=w?[path.join(npmGlobal,'node_modules','@img','sharp-libvips-win32-x64','lib','libvips-42.dll'),path.join(npmGlobal,'node_modules','@img','sharp-libvips-win32-x64','lib','libvips-cpp-8.17.3.dll'),path.join(npmGlobal,'node_modules','sharp','build','Release','sharp-win32-x64.node')]:[];for(const dll of dllPaths){if(!fs.existsSync(dll))continue;let freed=false;for(let i=0;i<40;i++){try{const fd=fs.openSync(dll,'r+');fs.closeSync(fd);freed=true;break}catch(e2){wait(50)}}if(!freed){try{fs.renameSync(dll,dll+'.locked-'+Date.now()+'-'+process.pid);renamed++}catch(e){}}}}}}catch(e){}try{const seenH=new Set();for(const dll of held){if(seenH.has(dll))continue;seenH.add(dll);if(!fs.existsSync(dll))continue;let freed=false;for(let i=0;i<40;i++){try{const fd=fs.openSync(dll,'r+');fs.closeSync(fd);freed=true;break}catch(e2){wait(50)}}if(!freed){try{fs.renameSync(dll,dll+'.locked-'+Date.now()+'-'+process.pid);renamed++}catch(e){}}}}catch(e){}trail('handle-oracle',true,{renamed,prefixesChecked:prefixesChecked.length,held:held.length});let swept=0;try{const candidates=w?[path.join(home,'AppData','Roaming','npm','node_modules'),path.join(path.dirname(process.execPath),'node_modules')]:['/usr/local/lib/node_modules',path.join(home,'.npm-global','node_modules')];for(const npmParent of candidates){if(!fs.existsSync(npmParent))continue;try{for(const entry of fs.readdirSync(npmParent)){if(entry.startsWith('.mneme-ai-')){try{fs.rmSync(path.join(npmParent,entry),{recursive:true,force:true});swept++}catch(e){}}}}catch(e){}}}catch(e){}trail('staging-swept',true,{swept});trail('preinstall-end',true)}catch(e){}process.exit(0)\"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
2.95.0High risk202026-06-13
2.94.0High risk202026-06-13
2.111.0High risk202026-06-13
2.93.0High risk202026-06-13
2.92.0High risk202026-06-13
2.91.0High risk202026-06-13
2.90.0High risk202026-06-13
2.89.0High risk202026-06-13
3.101.0High risk202026-06-11
3.100.0High risk202026-06-11
3.99.0High risk402026-06-11
3.98.0High risk202026-06-11
3.97.0High risk202026-06-11
3.96.0High risk202026-06-11
3.95.0High risk202026-06-11
3.94.0High risk202026-06-11
3.93.0High risk202026-06-11
3.92.0High risk202026-06-11
3.91.0High risk202026-06-11
3.90.0High risk202026-06-11
3.89.0High risk202026-06-11
3.88.0High risk202026-06-11
3.87.0High risk202026-06-11
3.86.0High risk202026-06-11
3.85.0High risk202026-06-11
3.84.0High risk202026-06-11
3.82.0High risk202026-06-11
3.83.0High risk202026-06-11
2.88.0High risk202026-06-10
2.87.0High risk202026-06-10
2.86.0High risk202026-06-10
2.110.0High risk402026-06-10
2.71.0High risk202026-06-10
2.72.0High risk202026-06-10
2.69.0High risk202026-06-10
2.70.0High risk202026-06-10
2.66.0High risk202026-06-10
2.65.0High risk402026-06-10
2.59.0High risk202026-06-10
2.57.0High risk202026-06-10
2.58.0High risk402026-06-10
3.81.0High risk402026-06-10
3.80.0High risk402026-06-10
3.79.0High risk202026-06-10
3.78.0High risk402026-06-10
3.77.0High risk202026-06-10
3.76.0High risk402026-06-10
3.75.0High risk402026-06-10
3.74.0High risk402026-06-10
3.73.0High risk202026-06-10
3.72.0High risk202026-06-10
3.71.0High risk202026-06-10
3.70.0High risk202026-06-10
3.69.0High risk202026-06-10
3.68.0High risk402026-06-10
3.67.0High risk222026-06-10
3.65.0High risk452026-06-10
3.66.0High risk452026-06-10
3.64.0High risk452026-06-10
3.63.0High risk452026-06-10
3.62.0High risk222026-06-10
3.60.0High risk452026-06-10
3.61.0High risk452026-06-10
3.59.0High risk452026-06-10
3.58.0High risk222026-06-10
3.57.0High risk222026-06-10
3.56.0High risk222026-06-10
3.55.0High risk222026-06-10
3.54.0High risk222026-06-10
3.53.0High risk452026-06-10
3.52.0High risk452026-06-10
3.51.0High risk452026-06-10
3.50.0High risk452026-06-10
3.49.0High risk222026-06-10
3.48.0High risk222026-06-10
3.47.0High risk222026-06-10
3.46.0High risk222026-06-10
3.45.0High risk452026-06-10
3.44.0High risk452026-06-10
3.43.0High risk222026-06-10
3.42.0High risk452026-06-10
3.41.0High risk222026-06-10
3.40.0High risk222026-06-10
3.39.0High risk222026-06-10
3.38.0High risk222026-06-10
3.37.0High risk222026-06-10
3.36.0High risk222026-06-10
3.35.1High risk222026-06-10
3.35.0High risk222026-06-10
3.34.0High risk222026-06-10
3.33.0High risk222026-06-10
3.32.0High risk452026-06-10
3.31.0High risk452026-06-10
3.30.0High risk452026-06-10
3.29.0High risk452026-06-10
3.28.0High risk222026-06-10
3.27.0High risk222026-06-10
3.26.0High risk222026-06-10
3.24.0High risk222026-06-10
3.25.0High risk222026-06-10
3.23.0High risk222026-06-10
3.22.0High risk202026-06-10
3.21.0High risk402026-06-10
3.20.0High risk202026-06-10
3.19.0High risk202026-06-10
3.17.0High risk202026-06-10
3.18.0High risk202026-06-10
3.16.0High risk202026-06-10
3.15.0High risk202026-06-10
3.14.0High risk202026-06-10
3.13.0High risk202026-06-10
3.12.0High risk202026-06-10
3.11.0High risk202026-06-10
3.10.0High risk202026-06-10
3.9.0High risk202026-06-10
3.8.0High risk202026-06-10
3.7.0High risk202026-06-10
3.6.0High risk202026-06-10
3.5.1High risk202026-06-10
3.5.0High risk202026-06-10
3.4.0High risk202026-06-10
3.4.1High risk202026-06-10
2.220.0High risk402026-06-10
2.219.0High risk202026-06-10
2.218.0High risk402026-06-10
2.217.0High risk202026-06-10
2.216.0High risk402026-06-10
2.215.0High risk202026-06-10
2.214.0High risk202026-06-10
2.213.0High risk202026-06-10
2.212.0High risk202026-06-10
2.211.0High risk202026-06-10
2.210.0High risk202026-06-10
2.209.0High risk202026-06-10
2.208.0High risk402026-06-10
2.207.0High risk202026-06-10
2.206.0High risk202026-06-10
2.205.0High risk202026-06-10
2.204.0High risk202026-06-10
2.203.0High risk402026-06-10
2.202.0High risk202026-06-10
2.201.0High risk402026-06-10
2.200.0High risk202026-06-10
2.199.0High risk202026-06-10
2.198.0High risk202026-06-10
2.197.0High risk202026-06-10
2.196.0High risk202026-06-10
2.195.0High risk202026-06-10
2.194.0High risk202026-06-10
2.193.0High risk202026-06-10
2.192.0High risk202026-06-10
2.190.0High risk402026-06-10
2.191.0High risk202026-06-10
2.175.0High risk202026-06-10
2.173.0High risk402026-06-10
2.172.0High risk202026-06-10
2.171.0High risk202026-06-10
2.170.0High risk402026-06-10
2.169.0High risk202026-06-10
2.168.0High risk202026-06-10
2.167.0High risk202026-06-10
2.166.0High risk202026-06-10
2.165.0High risk202026-06-10
2.164.0High risk202026-06-10
2.149.0High risk202026-06-10
2.150.0High risk402026-06-10
2.143.0High risk202026-06-10
2.142.0High risk402026-06-10
2.141.0High risk202026-06-10
2.139.0High risk402026-06-10
2.140.0High risk202026-06-10
2.133.0High risk202026-06-10
2.134.0High risk202026-06-10
2.130.0High risk202026-06-10
2.129.0High risk402026-06-10
2.128.0High risk202026-06-10
2.127.0High risk202026-06-10
2.126.0High risk202026-06-10
2.125.0High risk202026-06-10
2.124.0High risk402026-06-10
2.123.0High risk202026-06-10
2.122.0High risk202026-06-10
2.121.0High risk202026-06-10
2.120.0High risk202026-06-10
2.119.0High risk202026-06-10
2.118.0High risk202026-06-10
2.117.0High risk202026-06-10
2.116.0High risk202026-06-10
2.115.0High risk402026-06-10
2.114.0High risk402026-06-10
2.113.0High risk202026-06-10
2.56.0High risk202026-06-10
2.55.0High risk402026-06-10
2.51.0High risk202026-06-10
2.52.0High risk202026-06-10
2.50.0High risk402026-06-10
2.47.0High risk402026-06-10
2.49.0High risk202026-06-10
2.48.0High risk202026-06-10
2.43.0High risk202026-06-10

Campaign attribution

Part of the Clob dropper campaign.

Block this in CI

PkgRadar gates mneme-ai (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]