chat-recall@0.7.9
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a concrete automatic path from a configured server response to local AI-agent instruction-file modification. This warrants a warning, but the source does not show unconsented npm lifecycle execution or a confirmed malicious payload.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The intent-drain routine runs while connected to a saved server.
Impact
A compromised or untrusted configured server could alter instructions consumed by local AI coding tools; no install-time attack was identified.
Mechanism
It fetches pending intents and routes code-apply intents to a function that appends text to instruction files.
AI rationale
The package contains a concrete automatic path from a configured server response to local AI-agent instruction-file modification. This warrants a warning, but the source does not show unconsented npm lifecycle execution or a confirmed malicious payload.
Evidence
dist/intent-drain.js
Network endpoints1
/api/sync-intents/pending
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes command-line and watch entrypoints, with no npm install lifecycle hook.
- Its intent drain polls each logged-in server for pending intents and executes them locally.
- A server-supplied code-apply intent can append supplied text to agent instruction files.
- The watch service also runs automatic updates for configured servers.
Evidence against
- No install-time lifecycle script was found in the manifest.
- The observed network requests use each saved server URL and its associated authorization token.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
18 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/auto-update.jsView file
340return { file: loc.execPath, args: [cli], env, shell: false };
L341: return { file: 'npm', args: [], env, shell: true };
L342: }
High
16Cross-file remote execution chain: dist/auto-update.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L16: */
L17: import { execSync, execFileSync } from 'node:child_process';
L18: import { readFileSync, existsSync } from 'node:fs';
...
L77: try {
L78: // dist/auto-update.js → dist/../package.json, i.e. the manifest of the
L79: // package this file was loaded from, whatever npm has since written there.
...
L81: const raw = readFileSync(join(here, '..', 'package.json'), 'utf-8');
L82: return JSON.parse(raw).version || null;
L83: }
...
L221: try {
L222: deps.restart(deps.platform ?? process.platform);
L223: }
Findings
2 Critical12 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/self-restart.js
HighShelldist/auto-update.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/auto-update.js
High
Affected versions and remediation
This report applies to chat-recall@0.7.9.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.7.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.