@recallai/desktop-sdk@2.0.37
Recall Desktop SDK
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe install-time download and native process launch are consistent with this desktop SDK's platform setup and runtime. Source inspection found no concrete attack behavior or unrelated credential destination.
Decision evidence
public snapshot- package.json runs setup.js during install; setup downloads native SDK archives from the Recall release host using the package commit identifier and platform.
- index.js launches the bundled desktop SDK process and forwards RECALL_ environment variables to it as SDK configuration.
- The inspected code shows no package-controlled credential transmission or unrelated network destination.
Source & flagged code
4 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json runs setup.js during install; setup downloads native SDK archives from the Recall release host using the package commit identifier and platform.
package.jsonView on unpkg · L14package.json runs setup.js during install; setup downloads native SDK archives from the Recall release host using the package commit identifier and platform.
Findings
Affected versions and remediation
This report applies to @recallai/desktop-sdk@2.0.37.
See all versions of @recallai/desktop-sdk for other recorded verdicts.
- Review the evidence and your use of @recallai/desktop-sdk@2.0.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.