
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
weavatrix-memory
Advanced tools
Bitemporal, evidence-carrying Rust memory and bounded context for Node.js and Bun
An independent agent-memory product that can answer two different questions: what was true then, and what did the agent know then?
weavatrix-memory keeps evidence-bearing facts on separate valid-time and known-time axes, projects deterministic graphs, and compiles the smallest context that fits an explicit token budget. The npm package runs the same Rust engine through Node-API; it needs no LLM, vector database, network service, async runtime, external graph database, or MCP server.
npm install weavatrix-memory
# or
bun add weavatrix-memory
const { Memory } = require('weavatrix-memory')
const memory = new Memory({
knownAt: 20,
nodes: [
{ id: 'task:1', kind: 'task', label: 'Fix query' },
{ id: 'file:1', kind: 'file', label: 'query.js' },
],
facts: [{
id: 'fact:1',
source: 'task:1',
relation: 'depends_on',
target: 'file:1',
validFrom: 10,
recordedAt: 12,
agentId: 'agent:1',
sessionId: 'session:1',
evidence: [{ kind: 'test', source: 'query-suite' }],
}],
})
const context = memory.compileContext({
seeds: ['task:1'],
validAt: 20,
knownAt: 20,
tokenBudget: 2_000,
maxDepth: 2,
})
console.log(context.view)
console.log(context.graph)
console.log(context.receipt)
The Rust product's equal-topology depth-two context benchmark at 100,000 nodes / 300,000 edges returned the same 13-node / 33-edge result in 0.193 ms, versus 5.042 ms for agentic-memory 0.4.2 (26.1x faster). Its more heavily validated bulk constructor lost to agentic-memory by 1.68x; that losing row remains published.
At the npm boundary, Graphology's topology-only depth-two query is intentionally faster: 0.009 ms versus 0.160 ms on Node 24, and 0.028 ms versus 0.188 ms on Bun 1.4. Weavatrix additionally filters valid/known time, checks scope, enforces the token budget, selects evidence, builds a provenance graph and receipt, crosses Node-API, and serializes the bundle. Calling those products equivalent would be misleading.
See the Node/Bun overlap report and the repository's complete memory, retrieval-quality, storage, codec, and competitor benchmarks.
One npm package supports Node.js 18+ and Bun 1.4+. Optional native packages cover Windows, macOS, and glibc Linux on x64 and arm64. Timestamps are integer Unix microseconds and must stay inside JavaScript's safe-integer range.
Memory owns its repository, package, release evidence, and MIT license. It can be used independently of every other Weavatrix product.
Repository: Weavatrix/weavatrix-memory · Rust crate: crates.io/crates/weavatrix-memory · License: MIT
FAQs
Bitemporal, evidence-carrying Rust memory and bounded context for Node.js and Bun
The npm package weavatrix-memory receives a total of 27 weekly downloads. As such, weavatrix-memory popularity was classified as not popular.
We found that weavatrix-memory demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.