registry / chat-recall / 0.7.6
chat-recall@0.7.6
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no install-time hook, but its running daemon automatically applies authenticated service-supplied agent guidance and can self-update. That remote control surface warrants a warning because local confirmation and content restrictions are not present in the inspected execution path.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the watch command, after which the daemon begins polling configured logged-in servers.
Impact
A compromised or over-privileged configured service could alter AI-agent guidance and update the local package. No confirmed secret theft or destructive attack was established.
Mechanism
Pending server intents are dispatched without a local confirmation step; a code-apply intent can append its supplied text to selected agent instruction targets. Server capability data can also initiate an update.
AI rationale
The package has no install-time hook, but its running daemon automatically applies authenticated service-supplied agent guidance and can self-update. That remote control surface warrants a warning because local confirmation and content restrictions are not present in the inspected execution path.
Evidence
dist/intent-drain.jsdist/watch.jsdist/auto-update.js
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes command-line entrypoints and has no install lifecycle hook.
- The intent drainer fetches pending instructions from every configured logged-in server using its stored bearer token.
- A server-supplied code-apply intent is dispatched to local recommendation handling.
- Recommendation handling appends supplied text to existing or newly created agent instruction files.
- The watch daemon automatically starts and repeatedly schedules this intent polling.
- The updater can install a downloaded archive globally through npm after querying the configured server.
Evidence against
- No package install, preinstall, or postinstall hook was found.
- The observed network destinations are configured logged-in servers rather than a hard-coded unrelated recipient.
- No direct secret-export sink or destructive filesystem operation was identified in the inspected paths.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
19 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/auto-update.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = chat-recall@0.7.0
matchedIdentity = npm:Y2hhdC1yZWNhbGw:0.7.0
similarity = 0.843
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/auto-update.jsView on unpkg340return { file: loc.execPath, args: [cli], env, shell: false };
L341: return { file: 'npm', args: [], env, shell: true };
L342: }
High
Findings
3 Critical12 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/auto-update.js
HighChild Processdist/self-restart.js
HighShelldist/auto-update.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
High
Affected versions and remediation
This report applies to chat-recall@0.7.6.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.7.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.