@cachly-dev/mcp-server@0.10.182
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: 124 MCP tools for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook only prints instructions, while agent and Git hooks are installed through explicit setup. The resulting persistent hook behavior and commit metadata submission warrant a warning, but the inspected code does not support a malicious or publish-blocking verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the package's setup flow; subsequent Git commits activate the installed hook.
Impact
Project commit metadata can be sent to the Cachly service, and agent behavior can be extended through installed hooks.
Mechanism
The hook invokes the latest package release with commit message, hash, and changed file names for ingestion. Ambient hooks are also installed into agent configuration.
AI rationale
The postinstall hook only prints instructions, while agent and Git hooks are installed through explicit setup. The resulting persistent hook behavior and commit metadata submission warrant a warning, but the inspected code does not support a malicious or publish-blocking verdict.
Evidence
dist/src/index.jsdist/src/cls-hook.jsdist/src/ambient-hooks.js.git/hooks/post-commit.claude/hooks/.claude/settings.json
Network endpoints1
api.cachly.dev
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install hook only prints setup instructions; it does not install agent hooks itself.
- The `autopilot` flow installs a Git post-commit hook and Claude ambient hooks into project configuration.
- The Git hook runs `npx @cachly-dev/mcp-server@latest` after commits and submits commit messages, hashes, and file names for ingestion.
- The ambient-hook module targets Claude hook settings; related code reads credentials from Cachly configuration and writes Cachly integration configuration.
- These actions are reachable through explicit setup commands, and the inspected destinations and service are Cachly-aligned.
Evidence against
- The postinstall script is informational and directs the user to run setup explicitly.
- The inspected source does not establish hidden credential forwarding to an unrelated recipient or unconsented install-time agent configuration mutation.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execSync as c}from"node:child_process";const f=e=>n=>{try{return c(`git config ${n}`,{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500}).trim()}catch{return""}};function t(e...
High
Findings
2 Critical11 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
CriticalPrevious Version Dangerous Deltadist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighShell
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighCommand Output Exfiltrationdist/src/index.js
HighSandbox Evasion Gated Capabilitydist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighTrigger Reachable Command Output Exfiltrationdist/src/index.js
High
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.182.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.182 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.