registry / @kahinmcp/kahin / 0.3.10

@kahinmcp/kahin@0.3.10

Kahin — CDP ansiklopedisi + anti-detect browser otomasyon MCP sunucusu. Kurulumda 22 AI CLI aracını otomatik tespit edip kendini kaydeder. Camoufox görsel varsayılandır; Obscura hızlı CDP işleri için opt-in'dir.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates detected third-party AI-agent configuration files, registering the package as an MCP server without a user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing @kahinmcp/kahin@0.3.10 with lifecycle scripts enabled.

Impact

Affected AI clients will execute `kahin` as a configured MCP server on later use.

Mechanism

automatic broad MCP client configuration injection

Policy narrative

The postinstall hook invokes setup(), which enumerates existing configurations for 22 AI clients and writes a `kahin` MCP entry into every detected config. This is an unconsented install-time mutation of broad foreign AI-agent control surfaces, causing those clients to launch the package later.

Rationale

Direct inspection confirms a concrete default postinstall control-surface mutation, not merely a scanner heuristic. Opt-out and idempotence do not provide prior consent.

Evidence

package.jsonbin/setup.mjsbin/kahin.mjslib/kahin-0.3.10-py3-none-any.whl~/.claude.json~/.cursor/mcp.json~/.config/Code/User/mcp.json~/.codex/config.toml

Decision evidence

public snapshot

@kahinmcp/kahin@0.3.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code