registry / claude-recall / 0.45.1
claude-recall@0.45.1
⚠ Under reviewPersistent memory for Claude Code and Pi with native Skills integration, automatic capture, failure learning, and project scoping
AI Security Review
scanned 1d ago · by lpm-firewall-aiInspected postinstall behavior performs local project bookkeeping, runs a repair command over existing Claude settings, and leaves hook activation to an explicit CLI command. The declared Anthropic SDK archive was unresolved, so its behavior remains unreviewed and the package cannot be marked clean from this evidence.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The SDK is loaded when the classifier initializes its Anthropic client.
Impact
The dependency's install-time and runtime behavior could not be resolved, so a clean verdict is not supported by this inspection.
Mechanism
The classifier imports the declared SDK; the bounded dependency snapshot did not provide inspectable source for that dependency.
AI rationale
Inspected postinstall behavior performs local project bookkeeping, runs a repair command over existing Claude settings, and leaves hook activation to an explicit CLI command. The declared Anthropic SDK archive was unresolved, so its behavior remains unreviewed and the package cannot be marked clean from this evidence.
Evidence
package.jsondist/hooks/llm-classifier.jsscripts/postinstall.js
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs a postinstall hook; that hook records the current project locally and presents hook setup as an explicit CLI command.
- Postinstall invokes automatic repair, which searches existing Claude settings; inspected code describes preserving existing configuration and repairing missing paths.
- The Anthropic SDK is a declared dependency and is required lazily by the classifier; its selected dependency archive was unresolved, so its source behavior could not be assessed.
Evidence against
- The inspected postinstall code does not automatically install hooks; it prints an explicit setup command.
- The inspected classifier call site lazily loads the SDK and uses a configurable timeout; no malicious behavior was established from the inspected package source.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
20 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
13if (!fs.existsSync(dest)) {
L14: fs.mkdirSync(dest, { recursive: true });
L15: }
...
L25: } else {
L26: fs.copyFileSync(srcPath, destPath);
L27: }
...
L48: // Set up database location in user's home directory
L49: const dbDir = path.join(os.homedir(), '.claude-recall');
L50:
L51: if (!fs.existsSync(dbDir)) {
L52: fs.mkdirSync(dbDir, { recursive: true, mode: 0o700 });
L53: console.log(`📁 Created database directory: ${dbDir}`);
Critical
Ai Agent Control Hijack
Findings
2 Critical16 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
CriticalTrigger Reachable Excluded Directory Payloaddist/cli/claude-recall-cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/claude-recall-cli.js
HighPayload In Excluded Dir.claude/hooks/search_enforcer.py
HighSemantic Analysis Limiteddist/cli/commands/hook-commands.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/cli/claude-recall-cli.js
HighKnown Malware Source Similaritydist/hooks/kiro-hooks.js
HighKnown Malware Source Similaritydist/hooks/memory-janitor.js
HighKnown Malware Source Similaritydist/memory/storage.js
Affected versions and remediation
This report applies to claude-recall@0.45.1.
See all versions of claude-recall for other recorded verdicts.
- Review the evidence and your use of claude-recall@0.45.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.