registry / claude-recall / 0.30.3

claude-recall@0.30.3

⚠ Under review

Persistent memory for Claude Code and Pi with native Skills integration, automatic capture, failure learning, and project scoping

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 85 file(s), 1.09 MB of source

Source & flagged code

10 flagged

package.jsonView file

Lines 13-53json

13 "skills/",

14 "scripts/postinstall.js",

15 "scripts/uninstall.js",

16 "README.md",

17 "LICENSE",

18 "docs/"

19 ],

20 "pi": {

21 "extensions": [

22 "./dist/pi/extension.js"

23 ],

24 "skills": [

25 "./skills/*.md"

26 ]

27 },

28 "directories": {

29 "doc": "docs",

30 "test": "tests"

31 },

32 "scripts": {

33 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "test": "jest",

35 "test:watch": "jest --watch",

36 "test:unit": "jest tests/unit",

37 "test:integration": "jest tests/integration",

38 "test:mcp": "jest tests/mcp",

39 "test:watch:unit": "jest --watch tests/unit",

40 "test:coverage": "jest --coverage",

41 "test:coverage:unit": "jest --coverage --maxWorkers=50% tests/unit",

42 "test:coverage:integration": "jest --coverage --maxWorkers=50% tests/integration",

43 "test:benchmarks": "jest tests/benchmarks",

44 "test:experimental": "jest tests/experimental",

45 "build": "tsc && mkdir -p dist/memory dist/config && cp src/memory/schema.sql dist/memory/ && (cp -r src/config/* dist/config/ 2>/dev/null || true) && chmod +x dist/cli/claude-recall-cli.js",

46 "build:cli": "tsc && chmod +x dist/cli/claude-recall-cli.js",

47 "dev": "ts-node",

48 "start": "ts-node src/server.ts",

49 "start:dev": "nodemon --exec ts-node src/server.ts",

50 "claude-recall": "ts-node src/cli/claude-recall-cli.ts",

51 "install:global": "npm run build && npm link",

52 "stats": "npm run claude-recall stats",

53 "search": "npm run claude-recall search",

dist/memory/database-adapter.jsView file

Lines 16-76javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys

dist/cli/claude-recall-cli.jsView file

Lines 394-434javascript

394 }

395 // Latest version from registry

396 let latest;

397 try {

398 latest = execSync('npm view claude-recall version', {

399 encoding: 'utf-8',

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

5const os

dist/services/claude-json-watcher.jsView file

Lines 175-215javascript

175 console.log('[WATCHER] Found content in entry.prompt');

176 }

177 else if (entry.display) {

178 content = entry.display;

179 console.log('[WATCHER] Found content in entry.display');

180

.claude/hooks/search_enforcer.pyView file

•path = .claude/hooks/search_enforcer.py kind = payload_in_excluded_dir sizeBytes = 9759 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/search_enforcer.pyView on unpkg

•path = .claude/hooks/search_enforcer.py kind = build_helper sizeBytes = 9759 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/search_enforcer.pyView on unpkg

dist/hooks/kiro-classifier.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-recall@0.28.0 matchedIdentity = npm:Y2xhdWRlLXJlY2FsbA:0.28.0 similarity = 0.929 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/hooks/kiro-classifier.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code