registry / chat-recall / 0.7.24
chat-recall@0.7.24
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the flagged credential and network behavior fits its disclosed session-sync purpose. Sync destinations come from the configured or saved chat-recall server, with secrets masked client-side.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs initialization or sync, or explicitly installs hooks that run during an AI session.
Impact
The intended effect is syncing session data to the selected server; the reviewed source does not show unrelated credential exfiltration or concealed execution.
Mechanism
Session data is sent to the configured or saved chat-recall server, with sync credentials sent to that server and secrets masked client-side.
AI rationale
The package has no install lifecycle hook, and the flagged credential and network behavior fits its disclosed session-sync purpose. Sync destinations come from the configured or saved chat-recall server, with secrets masked client-side.
Evidence
package.jsonREADME.mddist/message-hook.jsdist/sync-client.js
Network endpoints2
chatrecall.dev (/api/sync; /api/live-sessions/event)User-configured or saved server URL (/api/sync; /api/live-sessions/event)
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines no install, preinstall, or postinstall hook; its scripts are for packaging and building.
- The README says `init` previews what would upload and waits for confirmation before the first sync, with explicit `--yes` and `--skip-sync` options.
- The README describes syncing sessions to the chat-recall service or a self-hosted server and says secrets are masked client-side.
- The message hook selects a server from the configured environment or saved credentials and posts to that selected server.
- The sync client sends to `/api/sync` with the saved server credential; the reviewed flow does not show a credential being redirected to an unrelated host.
Evidence against
- The package syncs session data to a remote server, which can include transcripts and related indexed content.
- The README says initialization proceeds with the preview in non-interactive mode, so a no-TTY `init` can sync without an interactive confirmation.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
18 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/auto-update.jsView file
349return { file: loc.execPath, args: [cli], env, shell: false };
L350: return { file: 'npm', args: [], env, shell: true };
L351: }
High
16Cross-file remote execution chain: dist/auto-update.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L16: */
L17: import { execSync, execFileSync } from 'node:child_process';
L18: import { readFileSync, existsSync } from 'node:fs';
...
L78: try {
L79: // dist/auto-update.js → dist/../package.json, i.e. the manifest of the
L80: // package this file was loaded from, whatever npm has since written there.
...
L82: const raw = readFileSync(join(here, '..', 'package.json'), 'utf-8');
L83: return JSON.parse(raw).version || null;
L84: }
...
L229: try {
L230: deps.restart(deps.platform ?? process.platform);
L231: }
Findings
3 Critical11 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/message-hook.js
HighChild Processdist/self-restart.js
HighShelldist/auto-update.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighCross File Remote Execution Contextdist/auto-update.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to chat-recall@0.7.24.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.7.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.