chat-recall@0.5.12
One memory across every AI coding tool — indexes Claude Code, Gemini CLI, Codex, OpenCode, Antigravity and Cursor sessions, redacts secrets, and exposes them to your agent over MCP.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe active daemon forwards stored credentials to unrestricted configured endpoints and trusts those endpoints to authorize a global self-update. The checksum protects transfer integrity but does not independently authenticate the supplied release.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the watch daemon triggers a check after 30 seconds and then every six hours.
Impact
An operator-configured or compromised endpoint can receive the existing token and supply a replacement package; no separate confirmed malicious payload is present in this release.
Mechanism
The daemon reads saved credentials, sends the token to the configured endpoint, accepts that endpoint's release metadata and checksum, then installs the downloaded archive globally.
AI rationale
The active daemon forwards stored credentials to unrestricted configured endpoints and trusts those endpoints to authorize a global self-update. The checksum protects transfer integrity but does not independently authenticate the supplied release.
Evidence
dist/watch.jsdist/auto-update.js
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The watch daemon automatically checks every saved credential target after startup and every six hours, forwarding its token as a Bearer header.
- The update flow obtains release metadata from that configured target, downloads its tarball, verifies a server-provided SHA-256 value, then globally installs it and restarts the service.
- Saved credentials can originate from environment variables or a credentials file and contain an unrestricted server URL plus token.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The downloaded archive is SHA-256 checked before installation, though the expected hash is supplied by the same configured server.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
17 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
1169for (var i = 0; i < flen; ) {
L1170: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L1171: lastPos = lastPos > -1 ? lastPos : 0;
...
L1404: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf);
L1405: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release);
L1406: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
...
L1969:
L1970: // ../../node_modules/thread-stream/package.json
L1971: var require_package = __commonJS({
...
L2014: type: "git",
L2015: url: "git+https://github.com/mcollina/thread-stream.git"
L2016: },
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/watch.jsView on unpkg · L116913153try {
L13154: const out2 = execFileSync2("powershell", [
L13155: "-NoProfile",
Findings
3 Critical10 High7 Medium5 Low
CriticalCredential Exfiltrationdist/watch.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/auto-update.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Persistencedist/cli.js
High
Affected versions and remediation
This report applies to chat-recall@0.5.12.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.5.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.