registry / AI-agent control-surface risk / @kahinmcp/kahin
@kahinmcp/kahin
Kahin — CDP ansiklopedisi + anti-detect browser otomasyon MCP sunucusu. Kurulumda 22 AI CLI aracını otomatik tespit edip kendini kaydeder. Camoufox görsel varsayılandır; Obscura hızlı CDP işleri için opt-in'dir.
This report shows the evidence for @kahinmcp/kahin@0.3.10. 7 of 7 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect inspection confirms a concrete default postinstall control-surface mutation, not merely a scanner heuristic. Opt-out and idempotence do not provide prior consent.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing @kahinmcp/kahin@0.3.10 with lifecycle scripts enabled.
Impact
Affected AI clients will execute `kahin` as a configured MCP server on later use.
Mechanism
automatic broad MCP client configuration injection
Policy narrative
The postinstall hook invokes setup(), which enumerates existing configurations for 22 AI clients and writes a `kahin` MCP entry into every detected config. This is an unconsented install-time mutation of broad foreign AI-agent control surfaces, causing those clients to launch the package later.
AI rationale
Direct inspection confirms a concrete default postinstall control-surface mutation, not merely a scanner heuristic. Opt-out and idempotence do not provide prior consent.
Evidence
package.jsonbin/setup.mjsbin/kahin.mjslib/kahin-0.3.10-py3-none-any.whl~/.claude.json~/.cursor/mcp.json~/.config/Code/User/mcp.json~/.codex/config.toml
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs `node bin/setup.mjs` at postinstall.
- bin/setup.mjs auto-detects 22 unrelated AI clients by user config paths.
- setup() runs by default unless KAHIN_SKIP_AUTO_SETUP or CI is set.
- upsertJson/TOML/YAML silently adds a `kahin` MCP command to each detected client config.
Evidence against
- Launcher installs the bundled wheel locally; no package-controlled network endpoint appears in bin scripts.
- The config mutation is idempotent and has an opt-out, but is still default install-time behavior.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStrings
CopyleftLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/setup.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/setup.mjsView file
9L10: import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from "node:fs";
L11: import { homedir } from "node:os";
...
L36: const CLIENTS = [
L37: // ---- JSON: root "mcpServers" ----
L38: {
L39: name: "Claude Code",
L40: file: join(HOME, ".claude.json"),
L41: root: "mcpServers",
L42: },
...
L47: : join(HOME, ".config", "Claude", "claude_desktop_config.json"),
L48: root: "mcpServers",
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/setup.mjsView on unpkg · L9lib/kahin-0.3.10-py3-none-any.whlView file
Findings
1 Critical2 High3 Medium5 Low
CriticalAi Agent Control Hijackbin/setup.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Bloblib/kahin-0.3.10-py3-none-any.whl
MediumEnvironment Vars
MediumShips Compressed Bloblib/kahin-0.3.10-py3-none-any.whl
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNested Archive Needs Inspectionlib/kahin-0.3.10-py3-none-any.whl
LowCopyleft License
Affected versions and remediation
This report applies to @kahinmcp/kahin@0.3.10.
The versions list below shows the verdict for each recorded version.
- Avoid installing @kahinmcp/kahin@0.3.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
7 known versions0.3.10latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 9, 2026, 7:36 PM0.3.9MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 8, 2026, 6:26 PM0.3.8MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 8, 2026, 5:29 PM0.3.7MaliciousSoft block: AI-agent control surfaceBlockPublished