@hailer/mcp@1.3.57

MCP server for Hailer - provides 52 tools to AI assistants (Claude Desktop, Claude Code).

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The package automatically modifies the project’s Claude skill directory during npm installation. The inspected content is a first-party Hailer skill, so this fits agent extension lifecycle risk and does not establish a publish-blocking attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with lifecycle scripts enabled.

Impact

The project’s Claude Code skills are modified and the bundled Hailer instructions become available to the agent.

Mechanism

The postinstall script copies the bundled .claude directory into the project root, recursively adding its skills.

AI rationale

Evidence

package.jsonscripts/postinstall.cjs.claude/skills/create-and-publish-app/SKILL.md.claude/skills/

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs scripts/postinstall.cjs automatically after installation.
The install script recursively copies the bundled .claude directory into the consuming project’s .claude directory.
The bundled content includes a Hailer app creation and publishing skill for Claude Code.
Server startup also calls an updater for an existing .mcp.json file.

Evidence against

The inspected .claude directory contains skills only; no hook files appeared in its file listing.
The .mcp.json update is reached during server startup, separate from the npm install hook.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 129 file(s), 1.67 MB of source, external domains: 127.0.0.1, api.hailer.com, app.hailer.com, apps.hailer.com, d1.awsstatic.com, docs.hailer.com, example.com, form.hailer.com, logs.hailer.local.gd

Source & flagged code

16 flagged

package.jsonView file

Lines 9-49json

9 "scripts": {

10 "dev": "tsx watch src/server/app.ts",

11 "claude-code-mcp": "DISABLE_CLIENT=true tsx src/server/app.ts",

12 "start-mcp-only": "DISABLE_CLIENT=true tsx src/server/app.ts",

13 "start-client-only": "DISABLE_MCP_SERVER=true tsx src/server/app.ts",

14 "build": "rm -rf dist && tsc && cp src/mcp/instructions.md dist/mcp/",

15 "prepack": "npm run build",

16 "start": "node dist/server/app.js",

17 "lint": "eslint src/ --max-warnings 0",

18 "pipeline-lint": "node node_modules/@hailer-repos/eslint-config/lint-new-violations.mjs -c eslint.config.mjs",

19 "typecheck": "tsc --noEmit -p tsconfig.eslint.json",

20 "build-dev-push": "rm -rf build/docker-dev && docker build --target artifacts --output build/docker-dev . -f Dockerfile.build-dev && docker buildx build --push --platform linux/amd64,linux/arm64/v8 -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-dev -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):dev -f ./Dockerfile.dev .",

21 "build-debug-push": "docker buildx build --push --platform linux/amd64,linux/arm64/v8 -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-debug -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):debug -f ./Dockerfile.debug .",

22 "build-prod-push": "rm -rf build/docker-prod && docker build --target artifacts --output build/docker-prod . -f Dockerfile.build-prod && docker buildx build --push --platform linux/amd64,linux/arm64/v8 -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs) -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):prod -f ./Dockerfile.prod .",

24 "build-k3d-dummy": "docker build --target artifacts --output build/docker-dev . -f Dockerfile.build-dev && docker build -f Dockerfile.dev . -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-dev && k3d image import $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-dev -c hailer",

25 "mcp-server": "hailer-mcp",

26 "release:patch": "npm version patch -m 'chore: release v%s' && git push && git push --tags && npm run build && npm publish --access public",

27 "release:minor": "npm version minor -m 'chore: release v%s' && git push && git push --tags && npm run build && npm publish --access public",

28 "release:major": "npm version major -m 'chore: release v%s' && git push && git push --tags && npm run build && npm publish --access public",

29 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "test": "vitest run",

31 "test:coverage": "vitest run --coverage",

32 "test:live": "vitest run --config vitest.live.config.ts",

33 "evals": "tsx evals/run-evals.ts",

34 "evals:bot": "tsx evals/run-bot-evals.ts",

35 "ci:trigger": "tsx test/live/trigger-pipeline.ts"

36 },

37 "files": [

38 "dist/",

39 "scripts/",

40 "!scripts/probe-mcp-pricing.ts",

41 ".claude/skills/",

42 ".opencode/",

43 "CLAUDE.md",

44 ".env.example",

45 "CHANGELOG.md",

46 "README.md"

47 ],

48 "dependencies": {

49 "@anthropic-ai/sdk": "^0.54.0",

scripts/postinstall.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * postinstall: Copies .claude/ (agents, skills, hooks) to the project root.

4 * Runs automatically after `npm install @hailer/mcp`.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L2

5 * Skips when installing in the hailer-mcp repo itself (development).

6 */

7const fs =

scripts/build-public-chat-knowledge.pyView file

•path = scripts/build-public-chat-knowledge.py kind = build_helper sizeBytes = 3462 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-public-chat-knowledge.pyView on unpkg

dist/bot/services/operation-logger.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 29

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bot/services/operation-logger.js#virtual:normalized:round1View on unpkg

dist/mcp/publish-auth-injector.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.56 matchedPath = dist/mcp/publish-auth-injector.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.56 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High