chat-recall@0.7.26
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe runtime telemetry is limited to operational metrics and metadata and has an opt-out, but it is enabled by default and conflicts with the README’s explicit “No telemetry” claim. This merits a warning for undisclosed telemetry; the inspected source does not show credential exfiltration or unrelated collection.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime sync activity records operational events; reporting occurs when telemetry is enabled and the configured server permits it.
Impact
Users may send operational usage data without disclosure in the package’s privacy statement.
Mechanism
The CLI posts sync metrics and limited runtime metadata to the configured server’s /api/client-events endpoint. The CLI provides an opt-out, but the README says no telemetry is collected.
AI rationale
The runtime telemetry is limited to operational metrics and metadata and has an opt-out, but it is enabled by default and conflicts with the README’s explicit “No telemetry” claim. This merits a warning for undisclosed telemetry; the inspected source does not show credential exfiltration or unrelated collection.
Evidence
README.mddist/cli.js
Network endpoints2
chatrecall.dev (default server)configured chat-recall server: /api/client-events
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The README says “No telemetry,” but the CLI implements collector telemetry.
- Telemetry is enabled unless opted out, and sent only when the connected server allows it; the CLI documents an opt-out.
- The telemetry contains sync counts and timings, CLI version, OS platform, and a hashed device marker, sent to the configured server’s /api/client-events endpoint.
Evidence against
- The package has no install or postinstall script; its manifest scripts are for packaging and building.
- Sync targets the server associated with the user’s configured credentials, and the telemetry code filters out events unless that server permits telemetry.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
17 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/auto-update.jsView file
349return { file: loc.execPath, args: [cli], env, shell: false };
L350: return { file: 'npm', args: [], env, shell: true };
L351: }
High
16Cross-file remote execution chain: dist/auto-update.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L16: */
L17: import { execSync, execFileSync } from 'node:child_process';
L18: import { readFileSync, existsSync } from 'node:fs';
...
L78: try {
L79: // dist/auto-update.js → dist/../package.json, i.e. the manifest of the
L80: // package this file was loaded from, whatever npm has since written there.
...
L82: const raw = readFileSync(join(here, '..', 'package.json'), 'utf-8');
L83: return JSON.parse(raw).version || null;
L84: }
...
L229: try {
L230: deps.restart(deps.platform ?? process.platform);
L231: }
Findings
2 Critical11 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/self-restart.js
HighShelldist/auto-update.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighCross File Remote Execution Contextdist/auto-update.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Persistence
Affected versions and remediation
This report applies to chat-recall@0.7.26.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.7.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.