claude-recall@0.37.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

claude-recall@0.37.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/memory/database-adapter.jsView file

56} L57: exec(sql) { L58: this.db.exec(sql);

High

Child Process

Package source references child process execution.

dist/memory/database-adapter.jsView on unpkg · L56

36exports.createDatabaseAdapter = createDatabaseAdapter; L37: const fs = __importStar(require("fs")); L38: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/memory/database-adapter.jsView on unpkg · L36

dist/cli/claude-recall-cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-recall@0.28.0 matchedIdentity = npm:Y2xhdWRlLXJlY2FsbA:0.28.0 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/claude-recall-cli.jsView on unpkg

422// Run npm install -g, streaming output so the user sees progress / errors live. L423: // shell: true on Windows — npm is npm.cmd there and a bare spawnSync ENOENTs. L424: // Pin the exact version `npm view` just resolved instead of `@latest`:

High

Shell

Package source references shell execution.

dist/cli/claude-recall-cli.jsView on unpkg · L422

156try { L157: const data = typeof memory.value === 'string' ? JSON.parse(memory.value) : memory.value; L158: const category = data.category || 'unknown'; ... L296: const seen = new Set(); L297: const home = os.homedir(); L298: const checkDir = (dir) => { ... L301: seen.add(dir); L302: const pkgPath = path.join(dir, 'node_modules', 'claude-recall', 'package.json'); L303: if (!fs.existsSync(pkgPath)) ... L386: async upgrade(opts = {}) { L387: const { execSync, spawnSync } = require('child_process'); L388: // Current version from package.json shipped with the installed binary

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/postinstall.jsView file

8Install-time AI-agent control hijack evidence: L13: if (!fs.existsSync(dest)) { L14: fs.mkdirSync(dest, { recursive: true }); L15: } ... L25: } else { L26: fs.copyFileSync(srcPath, destPath); L27: } ... L48: // Set up database location in user's home directory L49: const dbDir = path.join(os.homedir(), '.claude-recall'); L50: L51: if (!fs.existsSync(dbDir)) { L52: fs.mkdirSync(dbDir, { recursive: true }); L53: console.log(`📁 Created database directory: ${dbDir}`); Payload evidence from .claude/hooks/search_enforcer.py: L8: State file: ~/.claude-recall/hook-state/{session_id}.json L9: Exit codes: 0 = allow, 2 = block L10: """ ... L51: 'git rebase', 'git checkout', 'git switch', 'git cherry-pick', L52: 'npm install', 'npm version', 'npm publish', 'npm pack', L53: 'npx',

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L8

dist/services/claude-json-watcher.jsView file

195console.log('[WATCHER] Spawning capture process...'); L196: const captureProcess = (0, child_process_1.spawn)('npx', ['claude-recall', 'capture', 'user-prompt'], { L197: stdio: ['pipe', 'pipe', 'pipe']

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/claude-json-watcher.jsView on unpkg · L195

.claude/hooks/search_enforcer.pyView file

•path = .claude/hooks/search_enforcer.py kind = payload_in_excluded_dir sizeBytes = 9759 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/search_enforcer.pyView on unpkg

•path = .claude/hooks/search_enforcer.py kind = build_helper sizeBytes = 9759 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/search_enforcer.pyView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 13-53json

13 "skills/",

14 "scripts/postinstall.js",

15 "scripts/uninstall.js",

16 "README.md",

17 "LICENSE",

18 "docs/"

19 ],

20 "pi": {

21 "extensions": [

22 "./dist/pi/extension.js"

23 ],

24 "skills": [

25 "./skills/*.md"

26 ]

27 },

28 "directories": {

29 "doc": "docs",

30 "test": "tests"

31 },

32 "scripts": {

33 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "test": "jest",

35 "test:watch": "jest --watch",

36 "test:unit": "jest tests/unit",

37 "test:integration": "jest tests/integration",

38 "test:mcp": "jest tests/mcp",

39 "test:watch:unit": "jest --watch tests/unit",

40 "test:coverage": "jest --coverage",

41 "test:coverage:unit": "jest --coverage --maxWorkers=50% tests/unit",

42 "test:coverage:integration": "jest --coverage --maxWorkers=50% tests/integration",

43 "test:benchmarks": "jest tests/benchmarks",

44 "test:experimental": "jest tests/experimental",

45 "build": "tsc && mkdir -p dist/memory dist/config && cp src/memory/schema.sql dist/memory/ && (cp -r src/config/* dist/config/ 2>/dev/null || true) && chmod +x dist/cli/claude-recall-cli.js",

46 "build:cli": "tsc && chmod +x dist/cli/claude-recall-cli.js",

47 "dev": "ts-node",

48 "start": "ts-node src/server.ts",

49 "start:dev": "nodemon --exec ts-node src/server.ts",

50 "claude-recall": "ts-node src/cli/claude-recall-cli.ts",

51 "install:global": "npm run build && npm link",

52 "stats": "npm run claude-recall stats",

53 "search": "npm run claude-recall search",

dist/memory/database-adapter.jsView file

Lines 16-76javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys

dist/cli/claude-recall-cli.jsView file

Lines 136-176javascript

136 }

137 return {

138 total: projectMemories.length,

139 byType

140 };

141 }

142 /**

143 * Show skills evolution breakdown

144 */

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2

3const fs = require('fs');

4const path = require('path');

5const os

dist/services/claude-json-watcher.jsView file

Lines 175-215javascript

175 console.log('[WATCHER] Found content in entry.prompt');

176 }

177 else if (entry.display) {

178 content = entry.display;

179 console.log('[WATCHER] Found content in entry.display');

180

.claude/hooks/search_enforcer.pyView file

•path = .claude/hooks/search_enforcer.py kind = payload_in_excluded_dir sizeBytes = 9759 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/search_enforcer.pyView on unpkg

•path = .claude/hooks/search_enforcer.py kind = build_helper sizeBytes = 9759 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/search_enforcer.pyView on unpkg

Lines 402-442javascript

402 stdio: ['pipe', 'pipe', 'pipe'],

403 }).trim();

404 }

405 catch (err) {

406 console.error('❌ Could not reach the npm registry.');

407 console.error(` ${err?.stderr?.toString().trim() || err?.message || 'unknown error'}`);

408 console.error('\nCheck your connection, then run `claude-recall upgrade` again.');

409 process.exit(1);

410 }

411 // `latest` is interpolated into an npm argument (via a shell on Windows) —

412 // accept only a plausible semver string from the registry response.

413 if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(latest)) {

414 console.error(`❌ Unexpected version string from the registry: "${latest}"`);

415 process.exit(1);

416 }

417 console.log(`Installed: ${current}`);

418 console.log(`Latest: ${latest}`);

419 const needsInstall = current !== latest;

420 if (needsInstall) {

421 console.log(`\n📦 Upgrading ${current} → ${latest}...\n`);

422 // Run npm install -g, streaming output so the user sees progress / errors live.

423 // shell: true on Windows — npm is npm.cmd there and a bare spawnSync ENOENTs.

424 // Pin the exact version `npm view` just resolved instead of `@latest`:

High

Shell

Package source references shell execution.

dist/cli/claude-recall-cli.jsView on unpkg · L422

425 // right after a publish, the dist-tag replica npm installs from can lag

426 // the metadata endpoint `npm view` read — `@latest` then silently

427 // reinstalls the OLD version with exit 0 (observed live on 0.34.0).

428 const install = spawnSync('npm', ['install', '-g', `claude-recall@${latest}`], {

429 stdio: 'inherit',

430 shell: process.platform === 'win32',

431 });

432 if (install.error && install.error.code === 'ENOENT') {

433 // spawn failed before npm ever ran — the EACCES advice below would be

434 // misleading here (previous behavior: status === null !== 0 fell

435 // through to the "sudo npm install" remediation for a missing npm)

436 console.error('\n❌ npm not found on PATH.');

437 console.error('\nInstall Node.js (which includes npm) ≥ 20.19, or fix your PATH, then re-run:');

438 console.error(' claude-recall upgrade');

439 process.exit(1);

440 }

441 if (install.status !== 0) {

442 // npm prints its own error — add the practical remediation on top