chat-recall@0.6.1
One searchable history across every AI coding tool — indexes the sessions those tools already write, redacts secrets, then serves memory, secret scanning and code findings to your agent over MCP.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not concrete malware because the risky actions require login, sync/watch use, or an explicit command, and there is no npm install lifecycle hook. Default-on server-driven self-update and broad agent-hook setup remain significant capability risk.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user logs in and syncs, uses the watch service, or runs chat-recall install-hooks.
Impact
A selected server can receive indexed session data and can supply a checksum-pinned replacement package; explicit hook setup changes future Claude Code hook execution.
Mechanism
Conversation sync, server-supplied self-update, and agent-hook configuration writes.
AI rationale
This is not concrete malware because the risky actions require login, sync/watch use, or an explicit command, and there is no npm install lifecycle hook. Default-on server-driven self-update and broad agent-hook setup remain significant capability risk.
Evidence
dist/sync-client.jsdist/auto-update.jsdist/cli.js~/.chat-recall/credentials.json~/.claude/hooks.json~/.claude/chat-recall-hooks/global npm installation prefix
Network endpoints1
chatrecall.dev
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Sync sends collected conversation payloads to the server saved after login.
- The self-updater is enabled by default, downloads from the logged-in server, globally reinstalls the package, and restarts a user service.
- The explicit install-hooks command rewrites hook configuration for every Claude profile.
Evidence against
- package.json has no install lifecycle hook.
- Network sync follows an explicit login target and rejects unsafe transport.
- Agent-hook installation requires the user to invoke the install-hooks command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
20 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
13177try {
L13178: const out2 = execFileSync2("powershell", [
L13179: "-NoProfile",
High
dist/telemetry.jsView file
128// eslint-disable-next-line @typescript-eslint/no-var-requires
L129: const { createHash } = require('node:crypto');
L130: return createHash('sha256').update(value).digest('hex').slice(0, 12);
Findings
3 Critical13 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/mcp-relay.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/mcp.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Context
Affected versions and remediation
This report applies to chat-recall@0.6.1.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.