@recallai/desktop-sdk@2.0.32
Recall Desktop SDK
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe install hook and network access support the stated desktop SDK function: setup.js retrieves the vendor's native archive using the package commit identifier, and index.js starts it during caller initialization. The inspected source did not establish an unrelated recipient, secret exfiltration, or other concrete attack behavior.
Decision evidence
public snapshot- The install hook runs setup.js, which fetches platform SDK archives from the Recall SDK release host using the package commit identifier.
- Runtime launches the extracted native SDK when the caller initializes the desktop SDK.
- The install download is package-aligned: it uses the Recall SDK release host and the package's own commit identifier.
- No unrelated credential collection, destination override, or foreign agent configuration mutation was identified in the inspected paths.
Source & flagged code
4 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe install hook runs setup.js, which fetches platform SDK archives from the Recall SDK release host using the package commit identifier.
package.jsonView on unpkg · L14The install hook runs setup.js, which fetches platform SDK archives from the Recall SDK release host using the package commit identifier.
Findings
Affected versions and remediation
This report applies to @recallai/desktop-sdk@2.0.32.
See all versions of @recallai/desktop-sdk for other recorded verdicts.
- Review the evidence and your use of @recallai/desktop-sdk@2.0.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.