npm JavaScript analyzed 13.15.0

claude-mem

v13.15.0

npm

Memory compression system for Claude Code - persist context across sessions

maintainer: thedotmack
license: Apache-2.0
first seen: 2026-05-22
last seen: 2026-08-14
releases · 30d: 9
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v13.15.0 · analyzer v32 · 12h ago

skills & prompt files 20

danger signals8

dynamic code execution new Function() package/dist/npx-cli/index.js :1134 r(){if(r.count++>KU){let n;try{n=t.read=new Function("r","return function(){return "+(je.freezeData?"Object.freeze":"")+"({"+t.map(o=>o==="__proto__"?"__proto_:r()":joe.test(o)?o+":r()":"["+JSON.strin
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose package/dist/npx-cli/index.js :101 32N9qEiU6qhutZEiu6LLfRpXfTbLM9MLaG",I3="https://us.i.posthog.com";_3=["version","os","os_version","is_wsl","arch","runtime","locale","ide","provider","runtime_mode","install_method","claude_code_versi
suspicious endpoint api.telegram.org package/openclaw/src/index.ts :468 const response = await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, {
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose package/plugin/scripts/transcript-watcher.cjs :16 32N9qEiU6qhutZEiu6LLfRpXfTbLM9MLaG",Yn="https://us.i.posthog.com";function tr(){return process.env.CLAUDE_MEM_TELEMETRY_KEY||Gn}function rr(){return process.env.CLAUDE_MEM_TELEMETRY_HOST||Yn}var Kn=["
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose package/plugin/scripts/worker-service.cjs :28 2N9qEiU6qhutZEiu6LLfRpXfTbLM9MLaG",Sde="https://us.i.posthog.com";Ede=["version","os","os_version","is_wsl","arch","runtime","locale","ide","provider","runtime_mode","install_method","claude_code_vers
suspicious endpoint api.telegram.org package/plugin/skills/mode-creator/scripts/configure-telegram.mjs :107 const response = await fetch(`https://api.telegram.org/bot${token}/${method}`, {
suspicious endpoint t.me package/plugin/skills/mode-creator/scripts/configure-telegram.mjs :170 console.log(`Open https://t.me/${bot.username}, press Start, and send any message.`);
suspicious bundled script suspicious bundled script package/openclaw/install.sh :419 if ! curl -fsSL https://bun.sh/install | bash; then

code evidence v13.15.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 30

filesystem 17

fs package/dist/index.js :9 import * as fs2 from "fs";
fs package/dist/sdk/index.js :9 import * as fs2 from "fs";
fs (weak) package/openclaw/src/index.test.ts :4 import { mkdtemp, readFile, rm } from "fs/promises";
fs (weak) package/plugin/scripts/bun-runner.js :3 import { existsSync, readFileSync, mkdirSync, appendFileSync, writeFileSync } from 'fs';
fs (weak) package/plugin/scripts/context-generator.cjs :1 h(require("path"),1),At=require("os"),X=require("fs"),Dt=require("bun:sqlite");var g=require("path"),R=require("os"),I=require("fs"),le=require("url");var m=require("fs"),ue=require("crypto"),T=requir
fs (weak) package/plugin/scripts/mcp-server.cjs :5 ar F,Hu,ut,hy,Fr=so(()=>{"use strict";F=require("fs"),Hu=require("crypto"),ut=require("path");io();hy=process.platform==="win32"});function yy(){return typeof __dirname<"u"?__dirname:(0,G.dirname)((0,
fs (weak) package/plugin/scripts/server-service.cjs :34 press:view"),Rl=require("node:path"),VQ=require("node:fs"),HQ=Rl.dirname,yC=Rl.basename,YQ=Rl.extname,mC=Rl.join,WQ=Rl.resolve;gC.exports=Cp;function Cp(t,e){var r=e||{};if(this.defaultEngine=r.defaul
fs (weak) package/plugin/scripts/statusline-counts.js :3 import { existsSync, readFileSync } from "fs";
fs (weak) package/plugin/scripts/transcript-watcher.cjs :7 var p,kt,D,ln,ce=Se(()=>{"use strict";p=require("fs"),kt=require("crypto"),D=require("path");ye();ln=process.platform==="win32"});function pn(){return typeof __dirname<"u"?__dirname:(0,m.dirname)((0,O
fs (weak) package/plugin/scripts/version-check.js :3 import { existsSync, readFileSync, rmSync } from 'fs';
fs (weak) package/plugin/scripts/worker-service.cjs :12 ,Zj)=>{Zj.exports=Yj;Yj.sync=gue;var Vj=require("fs");function hue(t,e){var r=e.pathExt!==void 0?e.pathExt:process.env.PATHEXT;if(!r||(r=r.split(";"),r.indexOf("")!==-1))return!0;for(var n=0;n<r.lengt
fs (weak) package/plugin/skills/mode-creator/scripts/configure-telegram.mjs :3 import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
fs (weak) package/plugin/skills/mode-creator/scripts/install-mode.mjs :11 } from 'node:fs';
fs package/plugin/skills/standup/standup.mjs :41 import { readFile, writeFile, mkdir, rmdir, rename, stat } from "node:fs/promises";
fs (weak) package/plugin/skills/version-bump/scripts/generate_changelog.js :2 const fs = require('fs');
fs package/plugin/sqlite/SessionStore.js :2 var b=require("path"),M=require("os"),U=require("fs"),ee=require("url");var he=null;function Re(i){return(he??process.stderr.write.bind(process.stderr))(i)}function k(i){Re(i)}var We=process.platform=
fs package/plugin/sqlite/observations/files.js :2 eList:()=>K});module.exports=M(V);var l=require("fs"),T=require("path");var o=require("path"),f=require("os"),u=require("fs"),k=require("url");var B=null;function G(i){return(B??process.stderr.write.b

shell / exec 12

shell package/dist/index.js :1703 import { execFile as execFile2, execSync, spawn as spawn2 } from "child_process";
shell package/dist/npx-cli/index.js :1135 $`+Buffer.byteLength(this.name)+`\r
shell package/dist/sdk/index.js :1703 import { execFile as execFile2, execSync, spawn as spawn2 } from "child_process";
shell (weak) package/plugin/scripts/bun-runner.js :2 import { spawnSync, spawn } from 'child_process';
shell (weak) package/plugin/scripts/context-generator.cjs :12 equire("os"),pe=h(require("path"),1),fe=require("child_process");var w=require("fs"),y=h(require("path"),1);var U={isWorktree:!1,worktreeName:null,parentRepoPath:null,parentProjectName:null};function
shell (weak) package/plugin/scripts/mcp-server.cjs :85 uire("path"),1),Ae=require("fs");var fu=require("node:child_process");function As(t,e,r){return(0,fu.spawn)(t,e??[],{windowsHide:!0,...r})}var K$=new Set([".cmd",".bat"]),G$=new Set([".exe",".com"]),S
shell (weak) package/plugin/scripts/server-service.cjs :65 ,VP,tE,X0,ire,wo=R(()=>{"use strict";rE=require("child_process");BP();Un=require("fs"),eE=Ze(require("path"),1);he();Wp();Jn();Xte=5e3,Zte=1e3,ere=Ue.supervisorRegistry();tre=5e3,VP=new Map;tE=class{r
shell (weak) package/plugin/scripts/transcript-watcher.cjs :15 quire("path"),1),h=require("fs");var st=require("node:child_process");function be(r,e,t){return(0,st.spawn)(r,e??[],{windowsHide:!0,...t})}var hn=new Set([".cmd",".bat"]),yn=new Set([".exe",".com"]),a
shell (weak) package/plugin/scripts/version-check.js :2 import { spawnSync } from 'child_process';
shell (weak) package/plugin/scripts/worker-service.cjs :12 var MU=$((u3e,Jl)=>{"use strict";var $U=require("child_process"),Ik=OU(),Ok=PU();function NU(t,e,r){let n=Ik(t,e,r),s=$U.spawn(n.command,n.args,n.options);return Ok.hookChildProcess(s,n),s}function Fu
shell (weak) package/plugin/scripts/worker-wrapper.cjs :2 t",{value:e,enumerable:!0}):n,e));var c=require("child_process"),p=k(require("path"),1),y=process.platform==="win32",P=__dirname,l=p.default.join(P,"worker-service.cjs"),t=null,a=!1;function r(e){let
shell package/plugin/skills/standup/standup.mjs :45 import { execSync } from "node:child_process";

network 10

net package/dist/npx-cli/index.js :102 atch{}}async function O3(t,e,r,i){await fetch(`${LA()}/capture/`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({api_key:t,event:e,distinct_id:Dd(),properties:r}),signa
net package/openclaw/dist/index.js :1 i){if(!z(i))return null;try{let a=await fetch(`${L(e)}${s}`,{m
net (weak) package/openclaw/src/index.test.ts :3 import { createServer, type Server, type IncomingMessage, type ServerResponse } from "node:http";
net package/openclaw/src/index.ts :309 const response = await fetch(`${workerBaseUrl(port)}${path}`, {
net (weak) package/plugin/scripts/mcp-server.cjs :245 escription:"Array of observation IDs to fetch (required)"}},required:["ids"],additionalProperties:!0},handler:async t=>await _t("/api/observations/batch",{body:t})},{name:"session_start_context",descr
net (weak) package/plugin/scripts/server-service.cjs :34 Ui=h(xr=>{"use strict";var{METHODS:wX}=require("node:http"),PC=xC(),_X=p0(),IX=ao(),kX=f0(),TX=o0(),AX=require("node:querystring"),{Buffer:DC}=require("node:buffer");xr.methods=wX.map(t=>t.toLowerCas
net (weak) package/plugin/scripts/transcript-watcher.cjs :17 atch{}}async function Vn(r,e,t,n){await fetch(`${rr()}/capture/`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({api_key:r,event:e,distinct_id:Qt(),properties:t}),signa
net (weak) package/plugin/scripts/worker-service.cjs :29 tch{}}async function Tde(t,e,r,n){await fetch(`${du()}/capture/`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({api_key:t,event:e,distinct_id:wc(),properties:r}),signa
net (weak) package/plugin/skills/mode-creator/scripts/configure-telegram.mjs :107 const response = await fetch(`https://api.telegram.org/bot${token}/${method}`, {
net package/plugin/ui/viewer-bundle.js :11 async()=>{try{i(!0),o(null);let v=await fetch(`https:

secrets 6

secrets package/dist/index.js :6398 const apiKey = process.env.ANTHROPIC_API_KEY ?? process.env.CLAUDE_MEM_ANTHROPIC_API_KEY ?? "";
secrets package/dist/npx-cli/index.js :101 import MA from"os";function NA(){return process.env.CLAUDE_MEM_TELEMETRY_KEY||x3}function LA(){return process.env.CLAUDE_MEM_TELEMETRY_HOST||I3}function UA(t){let e={};for(let r of _3)t[r]!==void 0&&(
secrets package/dist/sdk/index.js :6398 const apiKey = process.env.ANTHROPIC_API_KEY ?? process.env.CLAUDE_MEM_ANTHROPIC_API_KEY ?? "";
secrets (weak) package/plugin/scripts/transcript-watcher.cjs :16 /us.i.posthog.com";function tr(){return process.env.CLAUDE_MEM_TELEMETRY_KEY||Gn}function rr(){return process.env.CLAUDE_MEM_TELEMETRY_HOST||Yn}var Kn=["version","os","os_version","is_wsl","arch","run
secrets (weak) package/plugin/scripts/worker-service.cjs :28 _naive"]),pF=200});function uu(){return process.env.CLAUDE_MEM_TELEMETRY_KEY||bde}function du(){return process.env.CLAUDE_MEM_TELEMETRY_HOST||Sde}function xc(t){return`
secrets (weak) package/plugin/skills/mode-creator/scripts/configure-telegram.mjs :151 let token = process.env.CLAUDE_MEM_TELEGRAM_BOT_TOKEN ?? '';

database 2

db package/dist/index.js :14 import pg from "pg";
db package/dist/sdk/index.js :14 import pg from "pg";

install hooks 1

prepublishOnly package/package.json :109 npm run build && node scripts/check-postinstall-allowlist.js

declared dependencies 56

@modelcontextprotocol/sdk@^1.29.0
@better-auth/api-key@^1.6.16
better-auth@^1.6.16
@anthropic-ai/claude-agent-sdk@^0.3.172
@clack/prompts@^1.3.0
ansi-to-html@^0.7.2
bullmq@^5.76.6
dompurify@^3.4.9
express@^5.2.1
ioredis@^5.10.1
pg@^8.20.0
posthog-node@^5.36.15
react@^19.2.6
react-dom@^19.2.6
shell-quote@^1.8.3
zod@^4.4.3
@derekstride/tree-sitter-sql@^0.3.11
@tree-sitter-grammars/tree-sitter-lua@^0.4.1
@tree-sitter-grammars/tree-sitter-markdown@^0.3.2
@tree-sitter-grammars/tree-sitter-toml@^0.7.0
@tree-sitter-grammars/tree-sitter-yaml@^0.7.1
@tree-sitter-grammars/tree-sitter-zig@^1.1.2
@types/bun@^1.3.13
@types/express@^5.0.6
@types/node@^25.9.2
@types/pg@^8.20.0
@types/react@^19.2.17
@types/react-dom@^19.2.3
esbuild@^0.28.0
np@^11.2.0
parse5@^8.0.1
postcss@^8.5.14
remark-mdx@^3.1.1
remark-parse@^11.0.0
tree-sitter-bash@^0.25.1
tree-sitter-c@^0.24.1
tree-sitter-cli@^0.26.8
tree-sitter-cpp@^0.23.4
tree-sitter-css@^0.25.0
tree-sitter-go@^0.25.0
tree-sitter-haskell@^0.23.1
tree-sitter-java@^0.23.5
tree-sitter-javascript@^0.25.0
tree-sitter-kotlin@^0.3.8
tree-sitter-php@^0.24.2
tree-sitter-python@^0.25.0
tree-sitter-ruby@^0.23.1
tree-sitter-rust@^0.24.0
tree-sitter-scala@^0.24.0
tree-sitter-scss@^1.0.0
tree-sitter-swift@^0.7.1
tree-sitter-typescript@^0.23.2
tsup@^8.5.1
typescript@^6.0.3
unified@^11.0.5
unist-util-visit@^5.1.0

perm:untrusted 1

untrusted package/plugin/ui/viewer-bundle.js :14 ,Va.useState)("");(0,Va.useEffect)(()=>{fetch(Nl.SETTINGS).then(async o=>{if(!o.ok)throw new Error(`