Loading npm security reports…

@codeatlas/mcp@4.0.0: AI-agent control-surface risk | LPM Firewall

registry / @codeatlas/mcp / 4.0.0

@codeatlas/mcp@4.0.0

CodeAtlas MCP server — 57 tools + 8 resources that expose live codebase architecture (routes, sequences, diffs, impact analysis, architecture violations, read-only SQL access) and AI-driven code review (per-entry-point review, evidence-gated findings, cus

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm postinstall, the package modifies multiple third-party AI-client configuration files and starts a per-workspace daemon that persists at login. This occurs automatically for a local install, without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall for a repository-local install

Impact

Adds a package-controlled MCP server to available AI clients and keeps it running across logins.

Mechanism

automatic broad MCP-client injection plus OS login persistence

Policy narrative

Installing the package executes dist/postinstall-hint.js. It detects the install workspace, writes a codeatlas MCP entry into detected third-party AI-client configs, and registers/starts a launchd, systemd-user, or Windows logon task that runs its server against that workspace. These actions are automatic rather than gated behind an explicit setup command.

Rationale

The package performs concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces and establishes login persistence. Its stated product purpose does not remove the install-time consent issue.

Evidence

package.jsonscripts/preinstall.jsdist/postinstall-hint.jsREADME.md~/.cursor/mcp.json~/.claude/settings.json~/.codex/config.json~/.continue/config.json~/.gemini/settings.json~/.config/codeatlas/setup-marker.json

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./scripts/preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/webview-ui/dist/assets/index2.jsView file

9patternName = generic_password severity = medium line = 9 matchedText = `)}`)}fu...ent.

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/webview-ui/dist/assets/index2.jsView on unpkg · L9

dist/mcp-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codeatlas/mcp@5.0.0 matchedIdentity = npm:QGNvZGVhdGxhcy9tY3A:5.0.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp-server.jsView on unpkg

80`))if(u.startsWith("SF:"))r=u.slice(3).trim(),r.startsWith(t)&&(r=r.slice(t.length+1)),s=0,o=0,a=0,c=0;else if(u.startsWith("FN:")){let d=u.slice(3).split(",");d[1]&&(l[d[1]]={hits... L81: `));if(!v){v=null;break e}R=Array(Vt(v)+1),v=Jn(v,R,0,R.length),R.length=v,Bt=R}v=Bt.shift()}return v},ub(v,R){R===null||R===10?(A(mt(v.output)),v.output=[]):R!=0&&v.output.push(R)... L82: PRAGMA foreign_keys = ON;

High

Child Process

Package source references child process execution.

dist/mcp-server.jsView on unpkg · L80

77})(${KPe(this.node)}) L78: `;return this.replaceWith(u)[0].get("arguments.0")}function lin(e){let t=e.params.findIndex(n=>Urn(n)||$rn(n));return t===-1?e.params.length:t}});var oke=_(Si=>{"use strict";Object... L79: ON CONFLICT(snapshot_kind, graph_id) DO UPDATE SET graph_json = excluded.graph_json`,[this.kind,t,JSON.stringify(n)]);this.dirty.clear()}forgetBodies(){this.cache.clear(),this.lru.... L80: `))if(u.startsWith("SF:"))r=u.slice(3).trim(),r.startsWith(t)&&(r=r.slice(t.length+1)),s=0,o=0,a=0,c=0;else if(u.startsWith("FN:")){let d=u.slice(3).split(",");d[1]&&(l[d[1]]={hits... L81: `));if(!v){v=null;break e}R=Array(Vt(v)+1),v=Jn(v,R,0,R.length),R.length=v,Bt=R}v=Bt.shift()}return v},ub(v,R){R===null||R===10?(A(mt(v.output)),v.output=[]):R!=0&&v.output.push(R)...

dist/postinstall-hint.jsView file

1"use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.protot... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> ... L29: </plist> L30: `}function ot(t){let e=process.env.XDG_CONFIG_HOME&&process.env.XDG_CONFIG_HOME.length>0?process.env.XDG_CONFIG_HOME:m.join(R.homedir(),".config");return m.join(e,"systemd","user",... L31: Description=CodeAtlas MCP \u2014 workspace ${t.workspacePath} ... L44: WantedBy=default.target L45: `}function it(t){return`CodeAtlas MCP ${t}`}function at(t){return m.join(j(),`${t}.task.xml`)}function _t(t){let e=at(t.id);F(m.dirname(e)),g.writeFileSync(e,Wt(t),"utf-8");let n=[... L46: <Tas

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/postinstall-hint.jsView on unpkg · L1

1Trigger-reachable persistence chain: scripts.postinstall -> dist/postinstall-hint.js L1: "use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.protot... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> ... L80: </Task> L81: `}function j(){return m.join(R.homedir(),".config","codeatlas","logs")}function Ht(t){F(j())}function F(t){g.mkdirSync(t,{recursive:!0})}function f(t){return t.replace(/&/g,"&"... L82: `;return yt(t.configPath,i),{client:t,status:p,backupPath:r,effectiveEntry:e}}function Gt(t,e){ht(t.configDir);let n="";if(t.configFileExists)try{n=u.readFileSync(t.configPath,"utf... L83: `;return yt(t.config

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/postinstall-hint.js

dist/tree-sitter.wasmView file

•path = dist/tree-sitter.wasm kind = wasm_module sizeBytes = 188635 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter.wasmView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 57-80json

57 "bin": {

58 "codeatlas-mcp": "./dist/mcp-server.js"

59 },

60 "files": [

61 "dist/mcp-server.js",

62 "dist/postinstall-hint.js",

63 "dist/sql-wasm.wasm",

64 "dist/tree-sitter.wasm",

65 "dist/grammars/**",

66 "dist/webview-ui/**",

67 "scripts/preinstall.js",

68 "README.md",

69 "LICENSE.md"

70 ],

71 "engines": {

72 "node": ">=18"

73 },

74 "scripts": {

75 "build": "node ../scripts/build-mcp-package.js",

76 "prepare": "npm run build",

77 "preinstall": "node ./scripts/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L77

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L77

78 "postinstall": "node ./dist/postinstall-hint.js"

79 }

80}

dist/webview-ui/dist/assets/index2.jsView file

Lines 1-29javascript

1import{r as xe}from"./index.js";const k=typeof __SENTRY_DEBUG__>"u"||__SENTRY_DEBUG__,$=globalThis,nn="10.56.0";function Gt(){return

dist/mcp-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codeatlas/mcp@5.0.0 matchedIdentity = npm:QGNvZGVhdGxhcy9tY3A:5.0.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp-server.jsView on unpkg

80`))if(u.startsWith("SF:"))r=u.slice(3).trim(),r.startsWith(t)&&(r=r.slice(t.length+1)),s=0,o=0,a=0,c=0;else if(u.startsWith("FN:")){let d=u.slice(3).split(",");d[1]&&(l[d[1]]={hits... L81: `));if(!v){v=null;break e}R=Array(Vt(v)+1),v=Jn(v,R,0,R.length),R.length=v,Bt=R}v=Bt.shift()}return v},ub(v,R){R===null||R===10?(A(mt(v.output)),v.output=[]):R!=0&&v.output.push(R)... L82: PRAGMA foreign_keys = ON;

High

Child Process

Package source references child process execution.

dist/mcp-server.jsView on unpkg · L80

77})(${KPe(this.node)}) L78: `;return this.replaceWith(u)[0].get("arguments.0")}function lin(e){let t=e.params.findIndex(n=>Urn(n)||$rn(n));return t===-1?e.params.length:t}});var oke=_(Si=>{"use strict";Object... L79: ON CONFLICT(snapshot_kind, graph_id) DO UPDATE SET graph_json = excluded.graph_json`,[this.kind,t,JSON.stringify(n)]);this.dirty.clear()}forgetBodies(){this.cache.clear(),this.lru.... L80: `))if(u.startsWith("SF:"))r=u.slice(3).trim(),r.startsWith(t)&&(r=r.slice(t.length+1)),s=0,o=0,a=0,c=0;else if(u.startsWith("FN:")){let d=u.slice(3).split(",");d[1]&&(l[d[1]]={hits... L81: `));if(!v){v=null;break e}R=Array(Vt(v)+1),v=Jn(v,R,0,R.length),R.length=v,Bt=R}v=Bt.shift()}return v},ub(v,R){R===null||R===10?(A(mt(v.output)),v.output=[]):R!=0&&v.output.push(R)...

dist/postinstall-hint.jsView file

1"use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.protot... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> ... L29: </plist> L30: `}function ot(t){let e=process.env.XDG_CONFIG_HOME&&process.env.XDG_CONFIG_HOME.length>0?process.env.XDG_CONFIG_HOME:m.join(R.homedir(),".config");return m.join(e,"systemd","user",... L31: Description=CodeAtlas MCP \u2014 workspace ${t.workspacePath} ... L44: WantedBy=default.target L45: `}function it(t){return`CodeAtlas MCP ${t}`}function at(t){return m.join(j(),`${t}.task.xml`)}function _t(t){let e=at(t.id);F(m.dirname(e)),g.writeFileSync(e,Wt(t),"utf-8");let n=[... L46: <Tas

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/postinstall-hint.jsView on unpkg · L1

1Trigger-reachable persistence chain: scripts.postinstall -> dist/postinstall-hint.js L1: "use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.protot... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> ... L80: </Task> L81: `}function j(){return m.join(R.homedir(),".config","codeatlas","logs")}function Ht(t){F(j())}function F(t){g.mkdirSync(t,{recursive:!0})}function f(t){return t.replace(/&/g,"&"... L82: `;return yt(t.configPath,i),{client:t,status:p,backupPath:r,effectiveEntry:e}}function Gt(t,e){ht(t.configDir);let n="";if(t.configFileExists)try{n=u.readFileSync(t.configPath,"utf... L83: `;return yt(t.config

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/postinstall-hint.js

dist/tree-sitter.wasmView file

•path = dist/tree-sitter.wasm kind = wasm_module sizeBytes = 188635 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter.wasmView on unpkg