@hailer/mcp@1.3.56: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@hailer/mcp@1.3.56: AI-agent control-surface risk | LPM Firewall

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/public-chat/session-store.jsView file

23exports.publicChatSessionStore = exports.PublicChatSessionStore = void 0; L24: const metrics_1 = require("../lib/metrics"); L25: const PUBLIC_CHAT_SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/public-chat/session-store.jsView on unpkg · L23

scripts/postinstall.cjsView file

2Install-time AI-agent control hijack evidence: L2: /** L3: * postinstall: Copies .claude/ (agents, skills, hooks) to the project root. L4: * Runs automatically after `npm install @hailer/mcp`. ... L30: if (!fs.existsSync(src)) return; L31: fs.mkdirSync(dest, { recursive: true }); L32: ... L41: if (entry.name === 'settings.local.json' && fs.existsSync(destPath)) continue; L42: fs.copyFileSync(srcPath, destPath); L43: } ... L54: L55: const src = path.join(__dirname, '..', '.claude'); L56: const dest = path.join(projectRoot, '.claude'); Payload evidence from .claude/skills/create-and-publish-app/SKILL.md: L60: 2. `src/hailer/use-app.ts` — `StoreSet` `replace?: boolean` → `replace?: false` (zustand v5 `tsc` fix). L61: 3. `src/App.tsx` — `process.env.NODE_ENV` → `import.meta.env.MODE` (the sc

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L2

scripts/build-public-chat-knowledge.pyView file

•path = scripts/build-public-chat-knowledge.py kind = build_helper sizeBytes = 3462 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-public-chat-knowledge.pyView on unpkg

dist/bot/services/operation-logger.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bot/services/operation-logger.js#virtual:normalized:round1View on unpkg

dist/mcp/publish-auth-injector.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = dist/mcp/publish-auth-injector.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/publish-auth-injector.jsView on unpkg

dist/scaffold-cli/app-codegen.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = dist/scaffold-cli/app-codegen.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scaffold-cli/app-codegen.jsView on unpkg

dist/scaffold-cli/bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = dist/scaffold-cli/bootstrap.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scaffold-cli/bootstrap.jsView on unpkg

dist/server/config.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = dist/server/config.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/config.jsView on unpkg

dist/mcp/tools/file.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = dist/mcp/tools/file.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/tools/file.jsView on unpkg

dist/mcp/utils/file-upload.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = dist/mcp/utils/file-upload.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/utils/file-upload.jsView on unpkg

dist/public-chat/graduate.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = dist/public-chat/graduate.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public-chat/graduate.jsView on unpkg

dist/mcp/tools/workflow-shared.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = dist/mcp/tools/workflow-shared.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/tools/workflow-shared.jsView on unpkg

dist/mcp/workspace-admin-store.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = dist/mcp/workspace-admin-store.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/workspace-admin-store.jsView on unpkg

scripts/smoke-public-chat-live.tsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.49 matchedPath = scripts/smoke-public-chat-live.ts matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.49 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/smoke-public-chat-live.tsView on unpkg