registry / AI-agent control-surface risk / @hailer/mcp
@hailer/mcp
MCP server for Hailer - provides 52 tools to AI assistants (Claude Desktop, Claude Code).
This report shows the evidence for @hailer/mcp@1.3.56. 2 of 8 known versions are blocked or flagged. The newest version, 1.7.0, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an unconsented postinstall mutation of a foreign AI-agent control surface. The absence of shell execution or observed exfiltration does not neutralize that automatic control-surface write.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install of @hailer/mcp
Impact
The package can alter instructions and capabilities available to Claude in the consumer project.
Mechanism
postinstall recursively copies .claude into the consumer project
Policy narrative
The npm postinstall hook walks upward to find a package.json belonging to the consumer project. It then recursively copies this package's .claude directory into that project's .claude directory. This occurs automatically during dependency installation, so agent behavior can be changed before the user explicitly invokes the package's CLI or setup flow.
AI rationale
This is an unconsented postinstall mutation of a foreign AI-agent control surface. The absence of shell execution or observed exfiltration does not neutralize that automatic control-surface write.
Evidence
package.jsonscripts/postinstall.cjs.claude/
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest runs a postinstall script automatically.
- The script locates the consuming project rather than remaining inside the package.
- It recursively copies the package's Claude directory into the consumer project's .claude directory.
Evidence against
- No runtime self-dependency is declared.
- The inspected installer does not execute shell commands or send network requests.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/public-chat/session-store.jsView file
23exports.publicChatSessionStore = exports.PublicChatSessionStore = void 0;
L24: const metrics_1 = require("../lib/metrics");
L25: const PUBLIC_CHAT_SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/public-chat/session-store.jsView on unpkg · L23Findings
1 Critical12 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/bot/services/operation-logger.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/mcp/publish-auth-injector.js
HighKnown Malware Source Similaritydist/scaffold-cli/app-codegen.js
HighKnown Malware Source Similaritydist/scaffold-cli/bootstrap.js
HighKnown Malware Source Similaritydist/server/config.js
HighKnown Malware Source Similaritydist/mcp/tools/file.js
HighKnown Malware Source Similaritydist/mcp/utils/file-upload.js
HighKnown Malware Source Similaritydist/public-chat/graduate.js
Affected versions and remediation
This report applies to @hailer/mcp@1.3.56.
The versions list below shows the verdict for each recorded version.
- Avoid installing @hailer/mcp@1.3.56. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.