chat-recall@0.5.27
One memory across every AI coding tool — indexes Claude Code, Gemini CLI, Codex, OpenCode, Antigravity and Cursor sessions, redacts secrets, and exposes them to your agent over MCP.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiNothing in package.json runs on npm install. The agent-config writes are real but happen only when the user runs init or the install commands, so this is an explicit-command agent capability warning rather than a hidden install hijack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs chat-recall init, install-skills, or install-hooks.
Impact
Those agents gain this package's tools, skills, or shell hooks, which can read local transcripts and send redacted session data to the user's chat-recall server.
Mechanism
The CLI copies skills and hook scripts and writes mcpServers or hook settings under Claude, Gemini, Codex, OpenCode, and Cursor homes, then can sync local sessions to the configured server.
AI rationale
Nothing in package.json runs on npm install. The agent-config writes are real but happen only when the user runs init or the install commands, so this is an explicit-command agent capability warning rather than a hidden install hijack.
Evidence
package.jsondist/cli.jsdist/install-skills.jshooks/chat_recall_save_hook.sh.mcp.json.claude.json.gemini/settings.json.cursor/mcp.json~/.claude/hooks.json
Network endpoints1
chatrecall.dev
Decision evidence
public snapshotAI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Bin entries are user-run CLIs; package.json defines no preinstall, install, or postinstall script.
- chat-recall init configures MCP and, unless skipped, installs a background sync service and can upload local sessions.
- writeMcpEntry writes mcpServers entries into Claude, Gemini, Cursor, Codex, and OpenCode config files.
- install-skills copies bundled skills into detected local agent skill directories and overwrites only marker-owned copies.
- install-hooks is a separate command that installs Claude Code shell hooks, including one documented for ~/.claude/hooks.json.
Evidence against
- No npm lifecycle hook runs these writers at install time.
- Skill install skips directories the user already owns.
- Session upload is aimed at the configured chat-recall server, default https://chatrecall.dev, after the user runs init or sync.
- No eval or Function payload loader was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
18 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
1200for (var i = 0; i < flen; ) {
L1201: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L1202: lastPos = lastPos > -1 ? lastPos : 0;
...
L1435: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf);
L1436: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release);
L1437: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
...
L2000:
L2001: // ../../node_modules/thread-stream/package.json
L2002: var require_package = __commonJS({
...
L2045: type: "git",
L2046: url: "git+https://github.com/mcollina/thread-stream.git"
L2047: },
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/watch.jsView on unpkg · L120013185try {
L13186: const out2 = execFileSync2("powershell", [
L13187: "-NoProfile",
Findings
3 Critical11 High7 Medium5 Low
CriticalCredential Exfiltrationdist/watch.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/auto-update.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
High
Affected versions and remediation
This report applies to chat-recall@0.5.27.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.5.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.