@bastra-recall/daemon: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@bastra-recall/daemon: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/statusline-session.jsView file

13*/ L14: import { execFileSync } from "node:child_process"; L15: import { mkdirSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/statusline-session.jsView on unpkg · L13

dist/usage-sidecar.jsView file

101try { L102: events.push(JSON.parse(line)); L103: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/usage-sidecar.jsView on unpkg · L101

dist/mcp-forwarder.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bastra-recall/daemon@0.8.1 matchedIdentity = npm:QGJhc3RyYS1yZWNhbGwvZGFlbW9u:0.8.1 similarity = 0.808 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp-forwarder.jsView on unpkg

41import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js"; L42: import { spawn } from "node:child_process"; L43: import * as path from "node:path"; ... L50: import { adoptTurn, defaultStatuslineState, } from "./statusline-feed.js"; L51: const DAEMON_URL = (process.env.BASTRA_DAEMON_URL ?? "http://127.0.0.1:6723").replace(/\/+$/, ""); L52: const API_TOKEN = process.env.BASTRA_API_TOKEN ?? "";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-forwarder.jsView on unpkg · L41

dist/cli/extension-install.jsView file

131const un = await claudeDesktopAdapter.uninstall({ dryRun: false }); L132: process.stdout.write(` · config registration: ${un.message}\n`); L133: } ... L139: // Hand the bundle to Claude Desktop — its dialog owns the final Install click. L140: spawn("open", [mcpbPath], { detached: true, stdio: "ignore" }).unref(); L141: process.stdout.write(`✓ handed ${mcpbPath} to Claude Desktop\n` + ... L143: ` Then make Desktop use memory on its own (2 min): ` + L144: `https://github.com/${REPO}/wiki/Claude-Desktop\n`); L145: return 0;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/extension-install.jsView on unpkg · L131

Source & flagged code

5 flagged

dist/statusline-session.jsView file

Lines 1-33javascript

1/**

2 * Per-session statusline feed paths.

3 *

4 * Claude Code does NOT send a session identifier to MCP servers

5 * (anthropics/claude-code#41836), so the forwarder cannot know which CC

6 * session it belongs to from the protocol. But the forwarder, the

7 * prompt-hook, and the statusline subprocess of ONE session all share the

8 * same `claude` ancestor process. We walk the parent chain up to that

9 * `claude` process and use its PID to namespace the feed file — so

10 * concurrent sessions never clobber each other's counters.

11 *

12 * Feed layout: ~/.bastra/statusline/<claude-session-pid>.json

13 */

14import { execFileSync } from "node:child_process";

15import { mkdirSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/statusline-session.jsView on unpkg · L13

16import * as os from "node:os";

17import * as path from "node:path";

18export const STATUSLINE_DIR = path.join(os.homedir(), ".bastra", "statusline");

19/**

20 * Shared, session-independent vault size, written by the daemon on every index

21 * change and read by every session's statusline segment.

22 *

23 * Why separate from the per-session feed: the forwarder only refreshes a

24 * session's `vault_size` on that session's own tool calls, so an idle session

25 * (no recalls) keeps showing a stale count after another session saves a

26 * memory. The daemon owns the vault and sees every add/remove, so it publishes

27 * the live count here; the segment prefers it over the per-session value.

28 *

29 * Not matched by reapStaleFeeds (which only deletes `<pid>.json`), so it

30 * survives feed reaping.

31 */

32export const SHARED_VAULT_FILE = path.join(STATUSLINE_DIR, "vault.json");

33export function writeSharedVaultSize(size) {

dist/usage-sidecar.jsView file

Lines 81-121javascript

81 entry[e.kind] += 1;

82 const tsField = `last_${e.kind}_at`;

83 // Events arrive roughly ordered, but a merge after compaction rotation may

84 // replay older lines — keep the max, not the last seen.

dist/mcp-forwarder.jsView file

Lines 21-61javascript

21 *

22 * Bootstrap:

23 * 1. GET /health probieren. 200 → Daemon läuft, weiter.

24 * 2. Sonst: detached

dist/cli/extension-install.jsView file

Lines 111-147javascript

111 }

112 }

113 if (!ok) {

114 process.stderr.write("✗ could not fetch a .mcpb bundle from GitHub releases — build one locally with\n" +

115 " `npm run build:mcpb:local --workspace=@bastra-recall/daemon` and re-run, or use the\n"