registry / chat-recall
chat-recall
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
This report shows the evidence for chat-recall@0.7.29. 0 of 41 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe reviewed credential flow is an explicit device login to the selected Chat Recall server, and sync sends the package’s session data to that configured service. No install hook or unrelated credential destination was found in the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Explicit login and sync commands; the watch daemon may check for updates while running.
Impact
These actions serve the package’s stated team knowledge and session-sync features; no unrelated credential collection or attack behavior was identified.
Mechanism
Device approval mints a token for the selected server. Sync requests send package data and that token to the server; updates are downloaded from the same server and checksum-verified.
AI rationale
The reviewed credential flow is an explicit device login to the selected Chat Recall server, and sync sends the package’s session data to that configured service. No install hook or unrelated credential destination was found in the inspected source.
Network endpoints1
chatrecall.dev
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI and MCP commands and declares no install, preinstall, or postinstall hook.
- The login flow obtains a device token through the selected server and uses it for requests to that server.
- Sync sends package session data to the configured server with its device token; this is the package’s stated feature.
- The updater downloads a versioned CLI tarball from the logged-in server and verifies its advertised checksum.
Evidence against
- The default server is chatrecall.dev, the package’s own service, and users can choose a server URL.
- The credential flow is an explicit login command with a visible device approval prompt.
- No source reviewed showed credentials being sent to an unrelated host or an attack running automatically.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
18 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/auto-update.jsView file
349return { file: loc.execPath, args: [cli], env, shell: false };
L350: return { file: 'npm', args: [], env, shell: true };
L351: }
High
16Cross-file remote execution chain: dist/auto-update.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L16: */
L17: import { execSync, execFileSync } from 'node:child_process';
L18: import { readFileSync, existsSync } from 'node:fs';
...
L78: try {
L79: // dist/auto-update.js → dist/../package.json, i.e. the manifest of the
L80: // package this file was loaded from, whatever npm has since written there.
...
L82: const raw = readFileSync(join(here, '..', 'package.json'), 'utf-8');
L83: return JSON.parse(raw).version || null;
L84: }
...
L229: try {
L230: deps.restart(deps.platform ?? process.platform);
L231: }
Findings
3 Critical11 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/mcp-relay.js
HighChild Processdist/self-restart.js
HighShelldist/auto-update.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighCross File Remote Execution Contextdist/auto-update.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to chat-recall@0.7.29.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of chat-recall@0.7.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.