registry / chat-recall / 0.7.12
chat-recall@0.7.12
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports a warning for guarded agent configuration and update capabilities, rather than a malware block. The warning rests on active server-driven writes and automatic installation, independently of citation coverage limits.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run the daemon with saved server credentials, or explicitly invoke toolkit commands.
Impact
Trust in the connected server extends to future agent instructions, MCP commands, and executable CLI releases without a fresh local approval for each operation.
Mechanism
Pending server intents drive local configuration writes; newer server releases trigger checksum-verified global npm installation unless updates are disabled.
AI rationale
Inspected source supports a warning for guarded agent configuration and update capabilities, rather than a malware block. The warning rests on active server-driven writes and automatic installation, independently of citation coverage limits.
Evidence
dist/watch.jsdist/intent-drain.jsdist/auto-update.jsCLAUDE.mdAGENTS.mdGEMINI.md
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has no preinstall, install, or postinstall hook.
- The running daemon fetches pending intents from logged-in servers and executes them locally.
- Server intents can append recommendations to project or global AI-agent instruction files.
- Toolkit pulls write MCP entries across supported agents, with platform, existing-entry, and redacted-secret checks.
- Automatic CLI updates default to enabled and install server-provided tarballs globally; an environment flag disables updates.
Evidence against
- Update URLs derive from the connected server, and downloaded bytes must match its advertised SHA-256.
- Agent setup is exposed through explicit CLI commands; no registry-install control-surface mutation was found.
- The flagged legacy migrations move package-owned data, and keyring access targets the package's vault passphrase.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
19 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/auto-update.jsView file
349return { file: loc.execPath, args: [cli], env, shell: false };
L350: return { file: 'npm', args: [], env, shell: true };
L351: }
High
16Cross-file remote execution chain: dist/auto-update.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L16: */
L17: import { execSync, execFileSync } from 'node:child_process';
L18: import { readFileSync, existsSync } from 'node:fs';
...
L78: try {
L79: // dist/auto-update.js → dist/../package.json, i.e. the manifest of the
L80: // package this file was loaded from, whatever npm has since written there.
...
L82: const raw = readFileSync(join(here, '..', 'package.json'), 'utf-8');
L83: return JSON.parse(raw).version || null;
L84: }
...
L229: try {
L230: deps.restart(deps.platform ?? process.platform);
L231: }
Findings
3 Critical12 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/watch.js
HighChild Processdist/self-restart.js
HighShelldist/auto-update.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
High
Affected versions and remediation
This report applies to chat-recall@0.7.12.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.7.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.