@kryptosai/mcp-observatory@1.37.2: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@kryptosai/mcp-observatory@1.37.2: Suspicious npm security report | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/ci-issue.jsView file

1import { execFile } from "node:child_process"; L2: import { mkdtemp, rm, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/src/ci-issue.jsView on unpkg · L1

dist/src/commands/demo.jsView file

10function packagedDemoTarget(timeoutMs) { L11: const require = createRequire(import.meta.url); L12: const here = path.dirname(fileURLToPath(import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/commands/demo.jsView on unpkg · L10

dist/src/commands/test.jsView file

242try { L243: execSync("command -v mcp-seatbelt 2>/dev/null || npx @kryptosai/mcp-seatbelt --version 2>/dev/null", { L244: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/commands/test.jsView on unpkg · L242

dist/src/checks/skill-scan.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/checks/skill-scan.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/checks/skill-scan.jsView on unpkg

dist/src/commands/helpers.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/commands/helpers.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/helpers.jsView on unpkg

dist/src/risk-graph.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/risk-graph.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/risk-graph.jsView on unpkg

dist/src/checks/attack-sim.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/checks/attack-sim.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/checks/attack-sim.jsView on unpkg

dist/src/checks/runtime-profile.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/checks/runtime-profile.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/checks/runtime-profile.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 81-121json

81 "docs/target-contribution-guide.md",

82 "docs/target-gallery.md",

83 "docs/target-registry.md",

84 "docs/tool-call-receipts.md",

85 "examples/demo-mcp-server.mjs",

86 "examples/insecure-mcp-server",

87 "scripts/postinstall.mjs",

88 "schemas"

89 ],

90 "scripts": {

91 "build": "tsc -p tsconfig.json",

92 "cli": "tsx src/cli.ts",

93 "dashboard:build": "tsx scripts/build-dashboard.ts",

94 "dashboard:validate": "node scripts/validate-dashboard.mjs",

95 "integration:real": "tsx scripts/run-real-server-matrix.ts",

96 "evaluate:permission-delta": "tsx scripts/evaluate-permission-delta-conformance.ts",

97 "evaluate:permission-delta:mcp-diff": "tsx scripts/run-mcp-diff-baseline.ts",

98 "safety-index": "tsx scripts/run-safety-index.ts",

99 "lint": "eslint .",

100 "prepack": "npm run build",

101 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L101

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L101

102 "proof:refresh": "tsx scripts/refresh-proof-artifacts.ts",

103 "release:prep": "node scripts/release.mjs",

104 "certification:pr-body": "tsx scripts/print-certification-pr-body.ts",

105 "typecheck": "tsc --noEmit -p tsconfig.json",

106 "test": "vitest run",

107 "test:permission-delta-model": "vitest run tests/permission-delta-model.test.ts",

108 "test:coverage": "vitest run --coverage",

109 "validate:artifacts": "tsx scripts/validate-artifacts.ts",

110 "verify:packed-install": "node scripts/verify-packed-install.mjs",

111 "smoke": "npm run cli -- run --target tests/fixtures/sample-target-config.json && npm run cli -- diff tests/fixtures/sample-run-a.json tests/fixtures/sample-run-b.json",

112 "boundary:check": "node scripts/check-repository-boundary.mjs"

113 },

114 "keywords": [

115 "mcp",

116 "mcp-server",

117 "model-context-protocol",

118 "ai-agent",

119 "agent-security",

120 "ai-supply-chain",

121 "ai-tools",

dist/src/ci-issue.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { mkdtemp, rm, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/src/ci-issue.jsView on unpkg · L1

3import { tmpdir } from "node:os";

4

dist/src/commands/demo.jsView file

Lines 1-30javascript

1import { createRequire } from "node:module";

2import path from "node:path";

3import { fileURLToPath } from "node:url";

4import { runTarget } from "../index.js";

dist/src/commands/test.jsView file

Lines 222-262javascript

222 }

223 else {

224 await maybeConvertPassingCheckToCi({

225 artifact,

226 target,

227 targetPath: options.target,

228 setupCi: conversionFlags.setupCi,

229 yes: conversionFlags.yes,

230

dist/src/checks/skill-scan.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/checks/skill-scan.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/checks/skill-scan.jsView on unpkg

dist/src/commands/helpers.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/commands/helpers.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/helpers.jsView on unpkg

dist/src/risk-graph.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/risk-graph.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/risk-graph.jsView on unpkg

dist/src/checks/attack-sim.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/checks/attack-sim.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/checks/attack-sim.jsView on unpkg

dist/src/checks/runtime-profile.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.36.4 matchedPath = dist/src/checks/runtime-profile.js matchedIdentity = npm:[redacted]:1.36.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/checks/runtime-profile.jsView on unpkg