Loading npm security reports…

@mearl/native-host@2.15.2: AI-agent control-surface risk | LPM Firewall

registry / @mearl/native-host / 2.15.2

@mearl/native-host@2.15.2

Native Messaging Host for Mearl — bridges Chrome Extension and local socket server

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically registers two Chrome Native Messaging hosts for Skills and MCP. This creates a persistent local bridge from a fixed browser extension to the package runtime.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation

Impact

A browser extension can start the package runtime and access its local agent and browser-control capabilities.

Mechanism

Automatic Chrome native-host registration and launcher creation

Policy narrative

On installation, npm runs the package with --init. The bundled initializer registers Skills and MCP Chrome Native Messaging hosts and writes launchers that execute the package runtime. This establishes a persistent browser-extension-to-local-runtime control path without requiring the installer to run the setup command themselves.

AI rationale

The postinstall hook automatically mutates a browser agent-control surface by registering native hosts and launchers. This meets the install-time control-surface blocking policy despite the fixed extension origin.

Evidence

package.jsondist/install.js~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.alibaba.mearl.skills.json~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.alibaba.mearl.mcp.json~/.config/google-chrome/NativeMessagingHosts/com.alibaba.mearl.skills.json~/.config/google-chrome/NativeMessagingHosts/com.alibaba.mearl.mcp.json

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/index.js --init || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node dist/index.js --init || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` ... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node dist/index.js --init || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

38mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost();DEFAULT_EXTENSION_ID="aoehhjnofngknnje... L40: `))!==-1;)lines.push(this.buffer.slice(0,newlineIndex)),this.buffer=this.buffer.slice(newlineIndex+1);return{lines,overflow:!1}}};import http2 from"node:http";import WebSocket from... L41: `),encoded="";for(let n=0;n<str.length;n++){let c2=str.charCodeAt(n);c2<128?encoded+=String.fromCharCode(c2):c2<2048?(encoded+=String.fromCharCode(c2>>6|192),encoded+=String.fromCh...

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L38

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` L5: `+prefix),args.push(colorCode+"m+"+module.exports.humanize(this.diff)+"\x1B[0m")}else args[0]=getDate()+name+" "+args[0]}function getDate(){return exports.inspectOpts.hideDate?"":n... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return this.inspectOpts.colors

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

8"${nodePath}" "${hostPath}" %*\r L9: `;return fs17.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path17.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.stri... L10: `);return fs17.writeFileSync(launcherPath,content,"utf-8"),fs17.chmodSync(launcherPath,493),launcherPath}async function installNativeHost(options={}){let{mode="both",extensionId=DE... L11: Permission denied. Try running with sudo.`),!1}}async function uninstallNativeHost(options={},dependencies={}){return uninstallNativeHostArtifacts(options,dependencies)}async funct... ... L38: mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost(

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node dist/index.js --init || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node dist/index.js --init || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` ... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node dist/index.js --init || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

38mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost();DEFAULT_EXTENSION_ID="aoehhjnofngknnje... L40: `))!==-1;)lines.push(this.buffer.slice(0,newlineIndex)),this.buffer=this.buffer.slice(newlineIndex+1);return{lines,overflow:!1}}};import http2 from"node:http";import WebSocket from... L41: `),encoded="";for(let n=0;n<str.length;n++){let c2=str.charCodeAt(n);c2<128?encoded+=String.fromCharCode(c2):c2<2048?(encoded+=String.fromCharCode(c2>>6|192),encoded+=String.fromCh...

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L38

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` L5: `+prefix),args.push(colorCode+"m+"+module.exports.humanize(this.diff)+"\x1B[0m")}else args[0]=getDate()+name+" "+args[0]}function getDate(){return exports.inspectOpts.hideDate?"":n... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return this.inspectOpts.colors

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

8"${nodePath}" "${hostPath}" %*\r L9: `;return fs17.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path17.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.stri... L10: `);return fs17.writeFileSync(launcherPath,content,"utf-8"),fs17.chmodSync(launcherPath,493),launcherPath}async function installNativeHost(options={}){let{mode="both",extensionId=DE... L11: Permission denied. Try running with sudo.`),!1}}async function uninstallNativeHost(options={},dependencies={}){return uninstallNativeHostArtifacts(options,dependencies)}async funct... ... L38: mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost(

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1