registry  /  crispy-recall  /  0.2.0

crispy-recall@0.2.0

Local session transcript memory for Claude Code and Codex — search past sessions with FTS5 + semantic vectors.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 1.05 MB of source, external domains: github.com, huggingface.co

Source & flagged code

2 flagged · loading source
dist/recall.jsView file
3259const nglArgs = gpu ? ["-ngl", String(gpu.ngl)] : []; L3260: const child = (0, import_node_child_process.spawn)(serverBin, [ L3261: "-m",
High
Child Process

Package source references child process execution.

dist/recall.jsView on unpkg · L3259
172Cross-file remote execution chain: dist/recall.js spawns dist/embed-pending.js; helper contains network access plus dynamic code execution. L172: for (let i = 0; i < namespace.length; i++) { L173: hash = (hash << 5) - hash + namespace.charCodeAt(i); L174: hash |= 0; ... L431: let m2; L432: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L433: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31? ... L476: if (!r2 && typeof process !== "undefined" && "env" in process) { L477: r2 = process.env.DEBUG; L478: } ... L517: const supportsColor = require("supports-color"); L518: if (supportsColor && (supportsColor.stderr || supportsColor).level >= 2) { L519: exports2.colors = [
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/recall.jsView on unpkg · L172

Findings

3 High2 Medium5 Low
HighChild Processdist/recall.js
HighShell
HighCross File Remote Execution Contextdist/recall.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings