registry / chat-recall / 0.7.8
chat-recall@0.7.8
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a concrete, automatically polled capability to modify AI-agent control files from server-provided intents. This warrants a warning because the behavior is gated by an existing configured server and daemon, but lacks per-write confirmation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the watch daemon with stored server credentials.
Impact
A configured server can influence project or global instructions consumed by AI coding tools without a per-write local confirmation.
Mechanism
The daemon polls for pending intents; a code-apply intent chooses instruction targets and appends its supplied text.
AI rationale
The package contains a concrete, automatically polled capability to modify AI-agent control files from server-provided intents. This warrants a warning because the behavior is gated by an existing configured server and daemon, but lacks per-write confirmation.
Evidence
dist/intent-drain.jsdist/watch.jsAGENTS.mdCLAUDE.mdGEMINI.md
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes executable command entry points and has no npm install lifecycle hook.
- A pending server intent can select global or project agent instruction targets and append arbitrary recommendation text.
- The intent drainer fetches pending intents using each stored server credential and treats returned intents as work.
- The watch daemon automatically schedules recurring intent-drain polls.
Evidence against
- The reviewed paths show no npm preinstall, install, or postinstall hook.
- The reviewed intent polling endpoint is selected from an existing stored server configuration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
18 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/auto-update.jsView file
340return { file: loc.execPath, args: [cli], env, shell: false };
L341: return { file: 'npm', args: [], env, shell: true };
L342: }
High
16Cross-file remote execution chain: dist/auto-update.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L16: */
L17: import { execSync, execFileSync } from 'node:child_process';
L18: import { readFileSync, existsSync } from 'node:fs';
...
L77: try {
L78: // dist/auto-update.js → dist/../package.json, i.e. the manifest of the
L79: // package this file was loaded from, whatever npm has since written there.
...
L81: const raw = readFileSync(join(here, '..', 'package.json'), 'utf-8');
L82: return JSON.parse(raw).version || null;
L83: }
...
L221: try {
L222: deps.restart(deps.platform ?? process.platform);
L223: }
Findings
2 Critical12 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/self-restart.js
HighShelldist/auto-update.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/auto-update.js
High
Affected versions and remediation
This report applies to chat-recall@0.7.8.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.7.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.