@hailer/mcp@1.3.52

MCP server for Hailer - provides 52 tools to AI assistants (Claude Desktop, Claude Code).

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The postinstall hook automatically installs package-owned Claude skills into the consumer project, creating an agent extension lifecycle risk. The inspected source shows first-party Hailer guidance and a narrowly scoped localhost port update, with no concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with npm, which runs its postinstall hook.

Impact

The package can add or replace Claude skill files in the consumer project, affecting later agent sessions.

Mechanism

The hook finds the project root and recursively copies the package's .claude directory into the project's .claude directory, with limited protection for existing settings.local.json files.

AI rationale

Evidence

package.jsonscripts/postinstall.cjs.claude/skills/hailer-api-client/SKILL.mddist/server/mcp-server.js.claude/

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package's postinstall hook runs scripts/postinstall.cjs.
The hook recursively copies the package's .claude directory into the consumer project's .claude directory, overwriting existing files except settings.local.json.
The copied content includes Hailer-specific Claude skill guidance.
On server startup, the package updates an existing .mcp.json entry only for the hailer server's localhost port.
The inspected source shows no malicious payload or credential transfer in this agent setup behavior.

Evidence against

The installed skills are first-party Hailer guidance, and the .mcp.json update is limited to the existing hailer localhost port argument.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 128 file(s), 1.64 MB of source, external domains: 127.0.0.1, api.hailer.com, app.hailer.com, apps.hailer.com, d1.awsstatic.com, docs.hailer.com, example.com, form.hailer.com, logs.hailer.local.gd

Source & flagged code

16 flagged

package.jsonView file

Lines 9-49json

9 "scripts": {

10 "dev": "tsx watch src/server/app.ts",

11 "claude-code-mcp": "DISABLE_CLIENT=true tsx src/server/app.ts",

12 "start-mcp-only": "DISABLE_CLIENT=true tsx src/server/app.ts",

13 "start-client-only": "DISABLE_MCP_SERVER=true tsx src/server/app.ts",

14 "build": "rm -rf dist && tsc && cp src/mcp/instructions.md dist/mcp/",

15 "prepack": "npm run build",

16 "start": "node dist/server/app.js",

17 "lint": "eslint src/ --max-warnings 0",

18 "pipeline-lint": "node node_modules/@hailer-repos/eslint-config/lint-new-violations.mjs -c eslint.config.mjs",

19 "typecheck": "tsc --noEmit -p tsconfig.eslint.json",

20 "build-dev-push": "rm -rf build/docker-dev && docker build --target artifacts --output build/docker-dev . -f Dockerfile.build-dev && docker buildx build --push --platform linux/amd64,linux/arm64/v8 -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-dev -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):dev -f ./Dockerfile.dev .",

21 "build-debug-push": "docker buildx build --push --platform linux/amd64,linux/arm64/v8 -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-debug -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):debug -f ./Dockerfile.debug .",

22 "build-prod-push": "rm -rf build/docker-prod && docker build --target artifacts --output build/docker-prod . -f Dockerfile.build-prod && docker buildx build --push --platform linux/amd64,linux/arm64/v8 -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs) -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):prod -f ./Dockerfile.prod .",

24 "build-k3d-dummy": "docker build --target artifacts --output build/docker-dev . -f Dockerfile.build-dev && docker build -f Dockerfile.dev . -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-dev && k3d image import $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-dev -c hailer",

25 "mcp-server": "hailer-mcp",

26 "release:patch": "npm version patch -m 'chore: release v%s' && git push && git push --tags && npm run build && npm publish --access public",

27 "release:minor": "npm version minor -m 'chore: release v%s' && git push && git push --tags && npm run build && npm publish --access public",

28 "release:major": "npm version major -m 'chore: release v%s' && git push && git push --tags && npm run build && npm publish --access public",

29 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "test": "vitest run",

31 "test:coverage": "vitest run --coverage",

32 "test:live": "vitest run --config vitest.live.config.ts",

33 "evals": "tsx evals/run-evals.ts",

34 "evals:bot": "tsx evals/run-bot-evals.ts",

35 "ci:trigger": "tsx test/live/trigger-pipeline.ts"

36 },

37 "files": [

38 "dist/",

39 "scripts/",

40 "!scripts/probe-mcp-pricing.ts",

41 ".claude/skills/",

42 ".opencode/",

43 "CLAUDE.md",

44 ".env.example",

45 "CHANGELOG.md",

46 "README.md"

47 ],

48 "dependencies": {

49 "@anthropic-ai/sdk": "^0.54.0",

scripts/postinstall.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * postinstall: Copies .claude/ (agents, skills, hooks) to the project root.

4 * Runs automatically after `npm install @hailer/mcp`.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L2

5 * Skips when installing in the hailer-mcp repo itself (development).

6 */

7const fs =

scripts/build-public-chat-knowledge.pyView file

•path = scripts/build-public-chat-knowledge.py kind = build_helper sizeBytes = 3462 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-public-chat-knowledge.pyView on unpkg

dist/bot/services/operation-logger.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bot/services/operation-logger.js#virtual:normalized:round1View on unpkg

dist/mcp/publish-auth-injector.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.56 matchedPath = dist/mcp/publish-auth-injector.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.56 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High