registry / claude-recall / 0.43.0

claude-recall@0.43.0

Persistent memory for Claude Code and Pi with native Skills integration, automatic capture, failure learning, and project scoping

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Source establishes automatic installation-time migration of existing package-owned agent hooks. Package-specific guards and backups warrant a warning under the lifecycle policy rather than a malware block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation or upgrade runs postinstall.

Impact

Existing agent hook execution can change without a fresh confirmation during installation.

Mechanism

Postinstall invokes repair with automatic approval across all scopes, replacing recognized stale package hook commands and backing up changed settings.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/cli/claude-recall-cli.jsdist/cli/commands/repair.js.claude/settings.json.claude/settings.local.json

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall hook runs the package installer automatically.
The installer invokes repair with automatic approval and all scopes; the CLI forwards those options.
Repair scans global Claude settings and existing project settings under the home directory.
Repair replaces broken or incompatible existing Claude Recall hook commands, with matching-command checks and backups.

Evidence against

Changes are limited to recognized existing Claude Recall hooks rather than arbitrary agent commands.
Repair preserves sibling configuration and backs up settings before writing; inspected behavior does not establish malicious intent.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 63 file(s), 891 KB of source

Source & flagged code

20 flagged

package.jsonView file

Lines 13-53json

13 "skills/",

14 "scripts/postinstall.js",

15 "scripts/uninstall.js",

16 "README.md",

17 "LICENSE",

18 "docs/"

19 ],

20 "pi": {

21 "extensions": [

22 "./dist/pi/extension.js"

23 ],

24 "skills": [

25 "./skills/*.md"

26 ]

27 },

28 "directories": {

29 "doc": "docs",

30 "test": "tests"

31 },

32 "scripts": {

33 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "test": "jest",

35 "test:watch": "jest --watch",

36 "test:unit": "jest tests/unit",

37 "test:integration": "jest tests/integration",

38 "test:mcp": "jest tests/mcp",

39 "test:watch:unit": "jest --watch tests/unit",

40 "test:coverage": "jest --coverage",

41 "test:coverage:unit": "jest --coverage --maxWorkers=50% tests/unit",

42 "test:coverage:integration": "jest --coverage --maxWorkers=50% tests/integration",

43 "test:benchmarks": "jest tests/benchmarks",

44 "bench:retrieval": "ts-node tests/benchmarks/retrieval-benchmark.ts",

45 "test:experimental": "jest tests/experimental",

46 "build": "tsc && mkdir -p dist/memory dist/config && cp src/memory/schema.sql dist/memory/ && (cp -r src/config/* dist/config/ 2>/dev/null || true) && chmod +x dist/cli/claude-recall-cli.js",

47 "build:cli": "tsc && chmod +x dist/cli/claude-recall-cli.js",

48 "dev": "ts-node",

49 "start": "ts-node src/server.ts",

50 "start:dev": "nodemon --exec ts-node src/server.ts",

51 "claude-recall": "ts-node src/cli/claude-recall-cli.ts",

52 "install:global": "npm run build && npm link",

53 "stats": "npm run claude-recall stats",

scripts/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

5const os

dist/cli/claude-recall-cli.jsView file

•path = dist/cli/claude-recall-cli.js kind = trigger_reachable_excluded_payload sizeBytes = 115749 triggerReachableSource = dist/cli/claude-recall-cli.js excludedPayload = .claude/hooks/search_enforcer.py

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/claude-recall-cli.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. process.exit(1); } } truncatecontent(content) { const str = typeof content === 'string' ? content : json.stringify(content); const maxlength = 100; if (str.length <= maxlength) return str; return str.substring(0, maxlength) + '...'; } } function getversion() { try { const packagejson = json.parse(fs.readfilesync(path.join(__dirname, '../../package.json'), 'utf-8')); return packagejson.version; } catch (error) { return '0.3.0'; } } async function main() { program .name('claude-recall') .descr

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/claude-recall-cli.jsView on unpkg

•matchType = token_shingles matchedPackage = claude-recall@0.38.0 matchedPath = dist/cli/claude-recall-cli.js matchedIdentity = npm:Y2xhdWRlLXJlY2FsbA:0.38.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

.claude/hooks/search_enforcer.pyView file

•path = .claude/hooks/search_enforcer.py kind = payload_in_excluded_dir sizeBytes = 10876 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/search_enforcer.pyView on unpkg

•path = .claude/hooks/search_enforcer.py kind = build_helper sizeBytes = 10876 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/search_enforcer.pyView on unpkg

dist/cli/commands/hook-commands.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/commands/hook-commands.js#virtual:normalized:round1View on unpkg

dist/hooks/kiro-hooks.jsView file

•matchType = normalized_sha256 matchedPackage = claude-recall@0.38.0 matchedPath = dist/hooks/kiro-hooks.js matchedIdentity = npm:Y2xhdWRlLXJlY2FsbA:0.38.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High