@cachly-dev/mcp-server@0.10.138
Your AI forgets everything between sessions. cachly fixes that permanently: 123 MCP tools for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run. Arrives pre-briefed. Free tier forever, EU servers, GDPR.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is not a malicious install hook because postinstall only prints setup instructions. The explicit setup command nevertheless establishes persistent agent and Git-hook behavior with a dynamically resolved package release, which warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs an explicit setup command such as autopilot or init, then makes a Git commit or uses the configured AI editor.
Impact
A project can gain ongoing package-controlled AI hooks and commit-data transmission; the configuration can preserve an API credential for a configurable endpoint.
Mechanism
Persistent editor and Git-hook setup with networked commit ingestion.
AI rationale
This is not a malicious install hook because postinstall only prints setup instructions. The explicit setup command nevertheless establishes persistent agent and Git-hook behavior with a dynamically resolved package release, which warrants a warning.
Evidence
dist/src/index.jsdist/src/cls-hook.jsdist/src/ambient-hooks.js.claude/mcp.json.claude/settings.json.claude/hooks/cachly-ambient-session-start.mjs.claude/hooks/cachly-ambient-prompt-submit.mjs.claude/hooks/cachly-ambient-pre-tool.mjs.claude/hooks/cachly-ambient-stop.mjs.git/hooks/post-commit
Network endpoints1
api.cachly.dev
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs a postinstall script that promotes an npx setup command.
- The install message says that setup writes MCP configurations and adds rules to CLAUDE.md.
- The runtime entrypoint implements explicit setup commands that write editor configuration, Claude hooks, and a Git post-commit hook; the hook invokes the latest package release on every commit and sends commit metadata to the Cachly API.
- The API base URL is environment-configurable, so the setup can persist a credential alongside a caller-selected service endpoint.
Evidence against
- The postinstall script only prints a message; it does not itself write files, run the setup command, or make network requests.
- The configuration and hook installation occur through explicit CLI setup commands, not automatically during npm installation.
- No runtime dependency on this package name is declared.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/bench/cachly-bench.jsView file
1import{EventEmitter as F}from"node:events";import{keywordSearch as $}from"../search.js";import{rerankByQuality as q}from"../rerank.js";import{BENCH_LESSONS as B,BENCH_QUERIES as k}...
L2: `)}const j=(()=>{try{return import.meta.url===`file://${process.argv[1]}`||process.argv[1]?.endsWith("cachly-bench.ts")||process.argv[1]?.endsWith("cachly-bench.js")}catch{return!1...
High
Child Process
Findings
1 Critical10 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/bench/cachly-bench.js
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighCommand Output Exfiltrationdist/src/index.js
HighSandbox Evasion Gated Capabilitydist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighTrigger Reachable Command Output Exfiltrationdist/src/index.js
HighRuntime Package Installdist/src/cls-hook.js
HighSemantic Analysis Limiteddist/src/doctor.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.138.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.138 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.