registry / @jefuriiij/synthra / 0.20.0

@jefuriiij/synthra@0.20.0

Local context engine for AI coding assistants — graph-based context, branch-aware memory, real-time human-activity awareness, deterministic Grep/Glob gating, and a live token dashboard.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit `syn .` setup modifies project-local Claude Code configuration and installs hooks that can gate tool calls. No install-time execution, remote payload loading, or confirmed exfiltration was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `syn .` in a project.

Impact

Can influence or deny Claude Code Grep, Glob, and Bash tool actions while Synthra is active.

Mechanism

Project-scoped Claude hooks, MCP registration, and local tool-call gating.

Rationale

The package creates a meaningful AI-agent control surface through explicit user-invoked project setup. It does not meet the block threshold because there is no install-time foreign-agent mutation or concrete malicious chain.

Evidence

package.jsonbin/syndist/cli/index.jsdist/server/index.jsCLAUDE.md.claude/settings.local.json.claude/hooks/synthra-*.mcp.json.synthra-graph/*.synthra/*

Network endpoints3

127.0.0.1:${port}/gate127.0.0.1:${mcpPort}/mcpregistry.npmjs.org/%40jefuriiij%2Fsynthra/latest

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/cli/index.js` installs Claude Code hook commands in `.claude/settings.local.json`.
Those hooks POST tool input to a local `/gate` service and can return a Claude permission deny decision.
`dist/cli/index.js` writes a Synthra policy block to `CLAUDE.md` directing agents to prefer its MCP tools.
Default `syn .` explicitly starts the local service, installs hooks, and registers project-scoped MCP.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
`bin/syn` only imports the CLI after the user invokes the executable.
Server binds to `127.0.0.1`; inspected hook traffic targets only localhost.
Registry access is a version check for the package's own npm name; no credential or source exfiltration found.
No bidi control characters were found in inspected distribution entrypoints.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.80 MB of source, external domains: 127.0.0.1, github.com, registry.npmjs.org, www.w3.org

Source & flagged code

2 flagged

dist/server/index.jsView file

Lines 44-84javascript

44 try {

45 await mkdir(dirname(this.persistPath), { recursive: true });

46 await appendFile(this.persistPath, JSON.stringify(event) + "\n", "utf8");

47 } catch {

48 }

49 }

50};

52// src/activity/file-watcher.ts

53import chokidar from "chokidar";

54import { readFile } from "fs/promises";

55import { join, relative, sep } from "path";

56import ignore from "ignore";

58// src/shared/logger.ts

59var LEVEL_PRIORITY = {

60 debug: 10,

61 info: 20,

62 warn: 30,

63 error: 40

64};

65var activeLevel = process.env.SYN_LOG_LEVEL ?? "info";

66function shouldLog(level) {

67 return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[activeLevel];

68}

69function emit(level, msg, ...args) {

70 if (!shouldLog(level)) return;

71 const stream = level === "error" || level === "warn" ? process.stderr : process.stdout;

72 stream.write(`[syn] ${msg}${args.length ? " " + args.map(String).join(" ") : ""}

73`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/index.jsView on unpkg · L64

74}

75var log = {

76 debug: (m, ...a) => emit("debug", m, ...a),

77 info: (m, ...a) => emit("info", m, ...a),

78 warn: (m, ...a) => emit("warn", m, ...a),

79 error: (m, ...a) => emit("error", m, ...a)

80};

82// src/activity/file-watcher.ts

83var ALWAYS_IGNORE = [

84 ".git",

Lines 3017-3057javascript

3017 const text = await readText(path);

3018 if (text === null) return null;

3019 try {

3020 return JSON.parse(text);

3021 } catch {

3022

Source & flagged code

2 flagged · loading source

dist/server/index.jsView file

3037contains invisible/control Unicode U+FEFF (zero width no-break space) const m = md.match(/^<U+FEFF>?\s*---\r?\n([\s\S]*?)\r?\n---/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/server/index.jsView on unpkg · L3037

64}; L65: var activeLevel = process.env.SYN_LOG_LEVEL ?? "info"; L66: function shouldLog(level) { ... L70: if (!shouldLog(level)) return; L71: const stream = level === "error" || level === "warn" ? process.stderr : process.stdout; L72: stream.write(`[syn] ${msg}${args.length ? " " + args.map(String).join(" ") : ""} L73: `); ... L165: // src/activity/git-watcher.ts L166: import { execFile } from "child_process"; L167: import { watch } from "fs"; ... L1553: const raw = await readFile4(path, "utf8"); L1554: const parsed = JSON.parse(raw);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/index.jsView on unpkg · L64

Findings

1 Critical3 Medium5 Low

CriticalTrojan Source Unicodedist/server/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/server/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/server/index.jsView file

Lines 44-84javascript

44 try {

45 await mkdir(dirname(this.persistPath), { recursive: true });

46 await appendFile(this.persistPath, JSON.stringify(event) + "\n", "utf8");

47 } catch {

48 }

49 }

50};

52// src/activity/file-watcher.ts

53import chokidar from "chokidar";

54import { readFile } from "fs/promises";

55import { join, relative, sep } from "path";

56import ignore from "ignore";

58// src/shared/logger.ts

59var LEVEL_PRIORITY = {

60 debug: 10,

61 info: 20,

62 warn: 30,

63 error: 40

64};

65var activeLevel = process.env.SYN_LOG_LEVEL ?? "info";

66function shouldLog(level) {

67 return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[activeLevel];

68}

69function emit(level, msg, ...args) {

70 if (!shouldLog(level)) return;

71 const stream = level === "error" || level === "warn" ? process.stderr : process.stdout;

72 stream.write(`[syn] ${msg}${args.length ? " " + args.map(String).join(" ") : ""}

73`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/index.jsView on unpkg · L64

74}

75var log = {

76 debug: (m, ...a) => emit("debug", m, ...a),

77 info: (m, ...a) => emit("info", m, ...a),

78 warn: (m, ...a) => emit("warn", m, ...a),

79 error: (m, ...a) => emit("error", m, ...a)

80};

82// src/activity/file-watcher.ts

83var ALWAYS_IGNORE = [

84 ".git",

Lines 3017-3057javascript

3017 const text = await readText(path);

3018 if (text === null) return null;

3019 try {

3020 return JSON.parse(text);

3021 } catch {

3022