registry / chat-recall / 0.7.7
chat-recall@0.7.7
⚠ Under reviewShared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource shows a user-run coding-memory CLI without npm install hooks, so it does not meet the block rule. A clean result is blocked because nine required files cannot fit in eight citations, and that coverage gap is not itself malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No install-time or import-time attack trigger was confirmed.
Impact
No confirmed unauthorized compromise, secret theft, or unconsented agent-control write from this review.
Mechanism
Lifecycle scripts are absent. Agent home paths are used by CLI and daemon features the user starts.
AI rationale
Source shows a user-run coding-memory CLI without npm install hooks, so it does not meet the block rule. A clean result is blocked because nine required files cannot fit in eight citations, and that coverage gap is not itself malicious behavior.
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json exposes CLI bins and build scripts only; there is no preinstall, install, or postinstall hook.
- Claude hook and skill writes are behind explicit chat-recall install-hooks and install-skills commands, not npm install.
- A clean verdict would need nine distinct file citations, but the citation list allows at most eight, so the clean decision cannot be finalized.
Evidence against
- No credential send to an unrelated host, obfuscated payload, or foreign agent-config write on install was found.
- Auto-update runs from the watch daemon against the logged-in server origin and can be turned off with CHAT_RECALL_AUTO_UPDATE=0.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
18 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/auto-update.jsView file
340return { file: loc.execPath, args: [cli], env, shell: false };
L341: return { file: 'npm', args: [], env, shell: true };
L342: }
High
16Cross-file remote execution chain: dist/auto-update.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L16: */
L17: import { execSync, execFileSync } from 'node:child_process';
L18: import { readFileSync, existsSync } from 'node:fs';
...
L77: try {
L78: // dist/auto-update.js → dist/../package.json, i.e. the manifest of the
L79: // package this file was loaded from, whatever npm has since written there.
...
L81: const raw = readFileSync(join(here, '..', 'package.json'), 'utf-8');
L82: return JSON.parse(raw).version || null;
L83: }
...
L221: try {
L222: deps.restart(deps.platform ?? process.platform);
L223: }
Findings
2 Critical12 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/self-restart.js
HighShelldist/auto-update.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/auto-update.js
High
Affected versions and remediation
This report applies to chat-recall@0.7.7.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.7.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.