Loading npm security reports…

@kahinmcp/kahin@0.3.8: AI-agent control-surface risk | LPM Firewall

registry / @kahinmcp/kahin / 0.3.8

@kahinmcp/kahin@0.3.8

Kahin — CDP ansiklopedisi + anti-detect browser otomasyon MCP sunucusu. Kurulumda 22 AI CLI aracını otomatik tespit edip kendini kaydeder. Camoufox görsel varsayılandır; Obscura hızlı CDP işleri için opt-in'dir.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates existing configuration files for a broad set of third-party AI clients. It registers an MCP server that later launches the package-controlled kahin command and its browser-automation stack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation (postinstall) when supported client config files exist

Impact

Affected AI clients may automatically expose the package's browser, file-upload, and automation capabilities.

Mechanism

unconsented broad AI-agent MCP configuration injection plus automatic runtime installation

Policy narrative

Installing the package invokes setup.mjs automatically. It detects existing configuration files for 22 separate AI clients and writes a kahin MCP entry into each, without a user setup command or consent prompt. Those clients can then invoke the package launcher, which provisions and runs its embedded browser-automation MCP server.

Rationale

This is a concrete, unconsented postinstall mutation of a broad foreign AI-agent control surface. The declared feature does not remove the installation-time control-hijack risk.

Evidence

package.jsonbin/setup.mjsbin/kahin.mjslib/kahin-0.3.8-py3-none-any.whl~/.claude.json~/.cursor/mcp.json~/.codex/config.toml~/.config/Code/User/mcp.json~/.local/share/kahin/venv

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/setup.mjsView file

9L10: import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs"; L11: import { homedir } from "node:os"; ... L36: const CLIENTS = [ L37: // ---- JSON: root "mcpServers" ---- L38: { L39: name: "Claude Code", L40: file: join(HOME, ".claude.json"), L41: root: "mcpServers", L42: }, ... L47: : join(HOME, ".config", "Claude", "claude_desktop_config.json"), L48: root: "mcpServers",

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/setup.mjsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = @kahinmcp/kahin@0.3.7 matchedPath = bin/setup.mjs matchedIdentity = npm:QGthaGlubWNwL2thaGlu:0.3.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/setup.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8c17a9845032cfa2 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kahinmcp/kahin@0.3.7 matchedPath = bin/setup.mjs matchedIdentity = npm:QGthaGlubWNwL2thaGlu:0.3.7 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/setup.mjsView on unpkg

lib/kahin-0.3.8-py3-none-any.whlView file

•path = lib/kahin-0.3.8-py3-none-any.whl kind = high_entropy_blob sizeBytes = 3662183 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/kahin-0.3.8-py3-none-any.whlView on unpkg

•path = lib/kahin-0.3.8-py3-none-any.whl kind = compressed_blob sizeBytes = 3662183 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/kahin-0.3.8-py3-none-any.whlView on unpkg

•path = lib/kahin-0.3.8-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 3662183 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/kahin-0.3.8-py3-none-any.whlView on unpkg

bin/kahin.mjsView file

•matchType = normalized_sha256 matchedPackage = @kahinmcp/kahin@0.3.7 matchedPath = bin/kahin.mjs matchedIdentity = npm:QGthaGlubWNwL2thaGlu:0.3.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kahin.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-29json

1{

2 "name": "@kahinmcp/kahin",

3 "version": "0.3.8",

4 "description": "Kahin \u2014 CDP ansiklopedisi + anti-detect browser otomasyon MCP sunucusu. Kurulumda 22 AI CLI arac\u0131n\u0131 otomatik tespit edip kendini kaydeder. Camoufox g\u00f6rsel varsay\u0131land\u0131r; Obscura h\u0131zl\u0131 CDP i\u015fleri i\u00e7in opt-in'dir.",

5 "bin": {

6 "kahin": "bin/kahin.mjs"

7 },

8 "scripts": {

9 "postinstall": "node bin/setup.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

10 "setup": "node bin/setup.mjs"

11 },

12 "files": [

13 "bin",

14 "lib",

15 "LICENSE",

16 "CHANGELOG.md",

17 "README.md",

18 "docs/juggler-ai-native.md"

19 ],

20 "engines": {

21 "node": ">=18"

22 },

23 "license": "AGPL-3.0",

24 "repository": {

25 "type": "git",

26 "url": "git+https://gitlab.com/void0x14/kahin-mcp.git"

27 },

28 "homepage": "https://gitlab.com/void0x14/kahin-mcp",

29 "bugs": {

bin/setup.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// kahin auto-setup — kurulu AI CLI istemcilerini tespit eder ve kahin MCP'yi kaydeder.

3// Idempotent: zaten kayıtlıysa atlar, mevcut config'leri merge eder (ezmez).

4// Opt-out: KAHIN_SKIP_AUTO_SETUP=1

5// El ile: kahin setup

6//

7// Client listesi, otomatik tespit yapan sistemlerden derlendi (add-mcp 15 ajan,

8// everymcp 15, mcpm 20+, getmcp 19, mcp-get 9, mcpkit): 22 client.

9

10import { existsSync, readFileSync, writeFileSync, mkdirSync } from

lib/kahin-0.3.8-py3-none-any.whlView file

•path = lib/kahin-0.3.8-py3-none-any.whl kind = high_entropy_blob sizeBytes = 3662183 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/kahin-0.3.8-py3-none-any.whlView on unpkg

•path = lib/kahin-0.3.8-py3-none-any.whl kind = compressed_blob sizeBytes = 3662183 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/kahin-0.3.8-py3-none-any.whlView on unpkg

•path = lib/kahin-0.3.8-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 3662183 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/kahin-0.3.8-py3-none-any.whlView on unpkg

bin/kahin.mjsView file

•matchType = normalized_sha256 matchedPackage = @kahinmcp/kahin@0.3.7 matchedPath = bin/kahin.mjs matchedIdentity = npm:QGthaGlubWNwL2thaGlu:0.3.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kahin.mjsView on unpkg