@cachly-dev/mcp-server@0.10.181
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: 124 MCP tools for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall script only advertises setup, while CLI setup installs a Git hook that automatically submits commit metadata after later commits. This supports a warning for user-invoked agent/project automation, not a confirmed malicious attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI setup flow that installs the Git hook; later commits activate it.
Impact
Commit metadata is sent automatically after commits while the hook remains installed.
Mechanism
The hook gathers the latest commit message, SHA, and changed file names, then runs the latest package release with `cls-ingest`.
AI rationale
The postinstall script only advertises setup, while CLI setup installs a Git hook that automatically submits commit metadata after later commits. This supports a warning for user-invoked agent/project automation, not a confirmed malicious attack.
Evidence
dist/src/cls-hook.jsdist/src/index.js.git/hooks/post-commit
Network endpoints1
api.cachly.dev
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook only prints a suggested setup command; it does not itself install the Git hook.
- The CLI setup path invokes the Git hook installer and reports writing it to `.git/hooks/post-commit`.
- The installed hook runs after commits, collects the commit message, SHA, and changed file names, then invokes the latest package release with `cls-ingest`.
- The CLI routes ingest data through its `cls_ingest` handler; the reviewed code does not establish an unrelated recipient.
Evidence against
- Once installed, the Git hook silently sends commit metadata on each commit without a fresh prompt; this is a real, user-invoked capability with continuing automatic effects.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execSync as c}from"node:child_process";const f=e=>n=>{try{return c(`git config ${n}`,{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500}).trim()}catch{return""}};function t(e...
High
Findings
2 Critical11 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
CriticalPrevious Version Dangerous Deltadist/src/handlers/cache.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighShell
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighCommand Output Exfiltrationdist/src/index.js
HighSandbox Evasion Gated Capabilitydist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighTrigger Reachable Command Output Exfiltrationdist/src/index.js
High
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.181.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.181 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.