registry / chat-recall / 0.7.20
chat-recall@0.7.20
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe inspected source supports user-directed operation and sync to configured targets, with the target’s token sent to that target and transport checks applied to configured credentials. The manifest has no install hook, and the scanner’s allegations are not established by the reviewed source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI, daemon, or MCP command that connects to a configured server.
Impact
No confirmed attack surface was established; the inspected source does not show hidden forwarding to an unrelated recipient.
Mechanism
The sync client reads credentials from environment settings or its credentials file, then posts sync data to that configured server and conditionally includes its associated token.
AI rationale
The inspected source supports user-directed operation and sync to configured targets, with the target’s token sent to that target and transport checks applied to configured credentials. The manifest has no install hook, and the scanner’s allegations are not established by the reviewed source.
Evidence
package.jsondist/sync-client.jsdist/cli.jsdist/watch.jsdist/mcp.jsdist/scan-worker.jsdist/keyring.jsdist/self-restart.jsdist/auto-update.jsdist/mcp-relay.js
Network endpoints1
chatrecall.dev
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes user-invoked command entrypoints and has no install lifecycle hook.
- The sync client sends payloads to each configured server and attaches that target’s saved token to the same server’s sync endpoint; environment and file credentials are loaded as explicit targets.
- The sync client checks target transport safety at login and again before sync, including for environment-supplied or previously saved targets.
- The inspected entrypoints and modules support the package’s CLI, daemon, MCP relay, keyring, and update functions; the inspected dependency files are ordinary library code.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
19 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/auto-update.jsView file
349return { file: loc.execPath, args: [cli], env, shell: false };
L350: return { file: 'npm', args: [], env, shell: true };
L351: }
High
16Cross-file remote execution chain: dist/auto-update.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L16: */
L17: import { execSync, execFileSync } from 'node:child_process';
L18: import { readFileSync, existsSync } from 'node:fs';
...
L78: try {
L79: // dist/auto-update.js → dist/../package.json, i.e. the manifest of the
L80: // package this file was loaded from, whatever npm has since written there.
...
L82: const raw = readFileSync(join(here, '..', 'package.json'), 'utf-8');
L83: return JSON.parse(raw).version || null;
L84: }
...
L229: try {
L230: deps.restart(deps.platform ?? process.platform);
L231: }
Findings
3 Critical12 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/mcp-relay.js
HighChild Processdist/self-restart.js
HighShelldist/auto-update.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
High
Affected versions and remediation
This report applies to chat-recall@0.7.20.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.7.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.