Loading npm security reports…

claude-recall: AI-agent control-surface risk | LPM Firewall

registry / claude-recall / 0.38.0

claude-recall@0.38.0

Persistent memory for Claude Code and Pi with native Skills integration, automatic capture, failure learning, and project scoping

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall launches an automatic repair over user-global and project Claude settings. It can rewrite hook commands in every discovered settings file under the home directory.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

Changes behavior-bearing AI-agent configuration across unrelated projects during package installation.

Mechanism

unconsented broad Claude Code hook-configuration mutation

Policy narrative

Installing the package runs `repair --auto --scope all`. That command enumerates Claude settings across the user home directory and rewrites matching hook commands, writing backups and replacement configuration without an interactive prompt. Although scoped to commands classified as claude-recall hooks, this is install-time mutation of a broad, foreign AI-agent control surface.

Rationale

The package performs unconsented postinstall mutation of user-global and arbitrary project Claude Code configuration. The guardrails do not remove the broad install-time control-surface write.

Evidence

scripts/postinstall.jsdist/cli/commands/repair.js~/.claude/settings.json~/.claude/settings.local.json$HOME/**/.claude/settings.json$HOME/**/.claude/settings.local.json~/.claude-recall/projects.json

Decision evidence

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/memory/storage.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-recall@0.37.0 matchedIdentity = npm:Y2xhdWRlLXJlY2FsbA:0.37.0 similarity = 0.881 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/memory/storage.jsView on unpkg

39exports.MemoryStorage = void 0; L40: const better_sqlite3_1 = __importDefault(require("better-sqlite3")); L41: const crypto = __importStar(require("crypto"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/memory/storage.jsView on unpkg · L39

scripts/postinstall.jsView file

13if (!fs.existsSync(dest)) { L14: fs.mkdirSync(dest, { recursive: true }); L15: } ... L25: } else { L26: fs.copyFileSync(srcPath, destPath); L27: } ... L48: // Set up database location in user's home directory L49: const dbDir = path.join(os.homedir(), '.claude-recall'); L50: L51: if (!fs.existsSync(dbDir)) { L52: fs.mkdirSync(dbDir, { recursive: true }); L53: console.log(`📁 Created database directory: ${dbDir}`);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L13

dist/cli/claude-recall-cli.jsView file

•path = dist/cli/claude-recall-cli.js kind = trigger_reachable_excluded_payload sizeBytes = 111743 triggerReachableSource = dist/cli/claude-recall-cli.js excludedPayload = .claude/hooks/search_enforcer.py

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/claude-recall-cli.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. id: ${key}`); console.log(` type: ${type}`); console.log(` confidence: ${confidence}`); this.logger.info('cli', 'memory stored', { key, type, confidence }); } catch (error) { console.error('❌ store failed:', error); this.logger.error('cli', 'store failed', error); process.exit(1); } } truncatecontent(content) { const str = typeof content === 'string' ? content : json.stringify(content); const maxlength = 100; if (str.length <= maxlength) return str; return str.substring(0, maxlength) + '...'; } }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/claude-recall-cli.jsView on unpkg

.claude/hooks/search_enforcer.pyView file

•path = .claude/hooks/search_enforcer.py kind = payload_in_excluded_dir sizeBytes = 10876 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/search_enforcer.pyView on unpkg

•path = .claude/hooks/search_enforcer.py kind = build_helper sizeBytes = 10876 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/search_enforcer.pyView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 13-53json

13 "skills/",

14 "scripts/postinstall.js",

15 "scripts/uninstall.js",

16 "README.md",

17 "LICENSE",

18 "docs/"

19 ],

20 "pi": {

21 "extensions": [

22 "./dist/pi/extension.js"

23 ],

24 "skills": [

25 "./skills/*.md"

26 ]

27 },

28 "directories": {

29 "doc": "docs",

30 "test": "tests"

31 },

32 "scripts": {

33 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "test": "jest",

35 "test:watch": "jest --watch",

36 "test:unit": "jest tests/unit",

37 "test:integration": "jest tests/integration",

38 "test:mcp": "jest tests/mcp",

39 "test:watch:unit": "jest --watch tests/unit",

40 "test:coverage": "jest --coverage",

41 "test:coverage:unit": "jest --coverage --maxWorkers=50% tests/unit",

42 "test:coverage:integration": "jest --coverage --maxWorkers=50% tests/integration",

43 "test:benchmarks": "jest tests/benchmarks",

44 "bench:retrieval": "ts-node tests/benchmarks/retrieval-benchmark.ts",

45 "test:experimental": "jest tests/experimental",

46 "build": "tsc && mkdir -p dist/memory dist/config && cp src/memory/schema.sql dist/memory/ && (cp -r src/config/* dist/config/ 2>/dev/null || true) && chmod +x dist/cli/claude-recall-cli.js",

47 "build:cli": "tsc && chmod +x dist/cli/claude-recall-cli.js",

48 "dev": "ts-node",

49 "start": "ts-node src/server.ts",

50 "start:dev": "nodemon --exec ts-node src/server.ts",

51 "claude-recall": "ts-node src/cli/claude-recall-cli.ts",

52 "install:global": "npm run build && npm link",

53 "stats": "npm run claude-recall stats",

dist/memory/storage.jsView file

Lines 19-59javascript

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

scripts/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3const fs = require('fs');

4const path = require('path');

5const os

dist/cli/claude-recall-cli.jsView file

•path = dist/cli/claude-recall-cli.js kind = trigger_reachable_excluded_payload sizeBytes = 111743 triggerReachableSource = dist/cli/claude-recall-cli.js excludedPayload = .claude/hooks/search_enforcer.py

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/claude-recall-cli.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. id: ${key}`); console.log(` type: ${type}`); console.log(` confidence: ${confidence}`); this.logger.info('cli', 'memory stored', { key, type, confidence }); } catch (error) { console.error('❌ store failed:', error); this.logger.error('cli', 'store failed', error); process.exit(1); } } truncatecontent(content) { const str = typeof content === 'string' ? content : json.stringify(content); const maxlength = 100; if (str.length <= maxlength) return str; return str.substring(0, maxlength) + '...'; } }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/claude-recall-cli.jsView on unpkg

.claude/hooks/search_enforcer.pyView file

•path = .claude/hooks/search_enforcer.py kind = payload_in_excluded_dir sizeBytes = 10876 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/search_enforcer.pyView on unpkg

•path = .claude/hooks/search_enforcer.py kind = build_helper sizeBytes = 10876 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/search_enforcer.pyView on unpkg