registry / @kahinmcp/kahin / 0.3.3

@kahinmcp/kahin@0.3.3

Kahin — CDP ansiklopedisi + anti-detect browser otomasyon MCP sunucusu. Kurulumda 22 AI CLI aracını otomatik tespit edip kendini kaydeder. Obscura ve Camoufox motorlarını kullanır, motor seçimini ajana bırakır.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically registers the kahin executable as an MCP server in detected third-party AI-client configurations. This is an unconsented, broad AI-agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation

Impact

Future launches of affected AI clients can invoke the package-provided kahin command.

Mechanism

automatic multi-client MCP configuration injection

Policy narrative

The postinstall runs bin/setup.mjs automatically. It detects existing configurations for 22 third-party AI clients and writes a kahin MCP entry into each matching configuration, including Codex and Claude. This causes those clients to launch the package executable in later sessions without an explicit user setup action.

Rationale

Source inspection confirms a postinstall hook that mutates a broad set of foreign AI-agent configuration files. This meets the install-control-surface block criterion regardless of the opt-out and merge safeguards.

Evidence

package.jsonbin/setup.mjsbin/kahin.mjslib/kahin-0.3.3-py3-none-any.whl~/.claude.json~/.cursor/mcp.json~/.config/Code/User/mcp.json~/.codex/config.toml

@kahinmcp/kahin@0.3.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code