@boomi/exosphere@8.1.3
A library of Web Components
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest activates a postinstall script that modifies the consumer project’s MCP configuration and registers this package’s server by default. This is unconsented install-time mutation of an AI-agent control surface, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package with lifecycle scripts enabled, unless the consumer has set the opt-out variable.
Impact
The project’s MCP client can load the registered server and expose its tools.
Mechanism
The hook writes an Exosphere server entry to the consuming project’s `.mcp.json`, launching the package’s MCP server with Node.
Policy narrative
During package installation, the postinstall hook adds or updates an Exosphere server entry in the consuming project’s `.mcp.json`. That entry launches this package’s MCP server, which exposes tools to the configured MCP client. An environment variable can skip setup, but installation performs the configuration change by default.
AI rationale
The manifest activates a postinstall script that modifies the consumer project’s MCP configuration and registers this package’s server by default. This is unconsented install-time mutation of an AI-agent control surface, so the package should be blocked.
Evidence
package.jsonscripts/postinstall-mcp.jsdist/mcp-server/index.js.mcp.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The postinstall hook runs the MCP setup script automatically.
- The script targets the consuming project’s `.mcp.json` and registers a command that launches this package’s MCP server.
- The script writes the registration into the project configuration; the server exposes MCP tools.
Evidence against
- The setup can be skipped with an environment variable, but the default install path performs the configuration write.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/postinstall-mcp.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/components/json-editor/json-editor.jsView file
1315padding: 0 8px;
L1316: }`}),ace.define("ace/ext/searchbox",["require","exports","module","ace/lib/dom","ace/lib/lang","ace/lib/event","ace/ext/searchbox-css","ace/keyboard/hash_handler","ace/lib/keys","a...
L1317: `,r:"\r",t:" ",'"':'"',"/":"/","\\":"\\"},W=97,M=(d.parse=function(u,l,c){var n={},s=0,o=0,i=0,a=c&&c.bigint&&typeof BigInt<"u";return{data:t("",!0),pointers:n};function t(I,$){e()...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/components/json-editor/json-editor.jsView on unpkg · L1315dist/mcp-server/index.jsView file
Findings
1 Critical3 High5 Medium7 Low
CriticalAi Agent Control Hijackscripts/postinstall-mcp.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/components/avatar/avatar.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/react/table/index.js
MediumDynamic Requiredist/mcp-server/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/components/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/components/json-editor/json-editor.js
LowFilesystem
Affected versions and remediation
This report applies to @boomi/exosphere@8.1.3.
See all versions of @boomi/exosphere for other recorded verdicts.
- Avoid installing @boomi/exosphere@8.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.