registry / chat-recall / 0.5.3
chat-recall@0.5.3
Local-first memory for AI coding tools — indexes Claude Code / Gemini CLI / OpenCode / Codex sessions, exposes them over MCP, optionally syncs redacted history to a chat-recall server
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source supports a warning for server-driven agent configuration and default automatic updates after server setup. It does not support classifying the package as malware or blocking publication.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run the watcher with saved sync server credentials, or explicitly drain server intents.
Impact
A compromised or untrusted configured server could influence agent behavior and replace the installed CLI; its checksum does not independently authenticate the publisher.
Mechanism
The client polls authenticated server intents, writes supplied rules to Claude instruction files, and installs newer server-advertised CLI tarballs by default.
AI rationale
The source supports a warning for server-driven agent configuration and default automatic updates after server setup. It does not support classifying the package as malware or blocking publication.
Evidence
dist/intent-drain.jsdist/watch.jsdist/auto-update.jsdist/sync-client.jsCLAUDE.mdCODE_TASKS.md
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The daemon polls saved sync servers and executes their pending intents automatically.
- Server-provided rules can be appended to project or global Claude instruction files without a local confirmation.
- CLI updates are enabled by default and install downloaded packages through npm after checking a server-provided checksum.
- Saving server credentials enables synchronization; the watcher drains intents every fifteen seconds.
- package.json has no npm installation lifecycle hooks or runtime self-dependency.
Evidence against
- The inspected agent integration locations in cli.js, mcp.js, and watch.js migrate only package-owned legacy data.
- Keyring access targets the package's vault passphrase; self-restart responds to changes in its own executable.
- Updates use the configured sync server and checksum verification, and can be disabled.
- No concrete covert exfiltration or malicious installation hook was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
16 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { statSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
11659try {
L11660: const out2 = execFileSync2("powershell", [
L11661: "-NoProfile",
High
1169for (var i = 0; i < flen; ) {
L1170: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L1171: lastPos = lastPos > -1 ? lastPos : 0;
...
L1404: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf);
L1405: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release);
L1406: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
...
L1969:
L1970: // ../../node_modules/thread-stream/package.json
L1971: var require_package = __commonJS({
...
L2014: type: "git",
L2015: url: "git+https://github.com/mcollina/thread-stream.git"
L2016: },
Findings
2 Critical10 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Persistencedist/cli.js
HighRuntime Package Installdist/auto-update.js
High
Affected versions and remediation
This report applies to chat-recall@0.5.3.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.5.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.