registry / claude-recall / 0.42.1
claude-recall@0.42.1
Persistent memory for Claude Code and Pi with native Skills integration, automatic capture, failure learning, and project scoping
AI Security Review
scanned 23d ago · by lpm-firewall-aiStatic source inspection establishes automatic agent hook migration during installation, constrained to existing claude-recall commands. The first-party extension lifecycle policy supports a warning; the inspected behavior does not justify blocking as malware.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm installation or upgrade when existing claude-recall hooks have broken or incompatible absolute paths.
Impact
Existing agent execution configuration can change without a fresh prompt during installation, although changes are limited to recognized package hooks.
Mechanism
Postinstall runs repair with automatic approval across all scopes; eligible commands become PATH-based claude-recall hook invocations, with backups.
AI rationale
Static source inspection establishes automatic agent hook migration during installation, constrained to existing claude-recall commands. The first-party extension lifecycle policy supports a warning; the inspected behavior does not justify blocking as malware.
Evidence
package.jsonscripts/postinstall.jsdist/cli/claude-recall-cli.jsdist/cli/commands/repair.js.claude/settings.json.claude/settings.local.json
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json automatically runs scripts/postinstall.js during installation.
- The install script invokes repair with automatic approval and all scopes.
- The CLI forwards automatic approval and scope to the repair implementation.
- Repair scans user and project agent settings throughout the home directory.
- Changes are restricted to broken or incompatible existing claude-recall hook commands and preserve backups.
Evidence against
- The inspected repair path does not install absent hooks or replace unrelated hook entries.
- MCP consolidation is separately gated by the explicit doctor --fix command.
- No credential exfiltration or remote payload execution was established in the inspected path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
20 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
13if (!fs.existsSync(dest)) {
L14: fs.mkdirSync(dest, { recursive: true });
L15: }
...
L25: } else {
L26: fs.copyFileSync(srcPath, destPath);
L27: }
...
L48: // Set up database location in user's home directory
L49: const dbDir = path.join(os.homedir(), '.claude-recall');
L50:
L51: if (!fs.existsSync(dbDir)) {
L52: fs.mkdirSync(dbDir, { recursive: true });
L53: console.log(`📁 Created database directory: ${dbDir}`);
Critical
Ai Agent Control Hijack
Findings
2 Critical16 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
CriticalTrigger Reachable Excluded Directory Payloaddist/cli/claude-recall-cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/claude-recall-cli.js
HighPayload In Excluded Dir.claude/hooks/search_enforcer.py
HighSemantic Analysis Limiteddist/cli/commands/hook-commands.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/cli/claude-recall-cli.js
HighKnown Malware Source Similaritydist/hooks/kiro-hooks.js
HighKnown Malware Source Similaritydist/hooks/memory-janitor.js
HighKnown Malware Source Similaritydist/memory/storage.js
Affected versions and remediation
This report applies to claude-recall@0.42.1.
See all versions of claude-recall for other recorded verdicts.
- Review the evidence and your use of claude-recall@0.42.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.