Loading npm security reports…

@mearl/native-host@2.17.1: Suspicious npm security report (Warn) | LPM Firewall

registry / @mearl/native-host / 2.17.1

@mearl/native-host@2.17.1

Native Messaging Host for Mearl — bridges Chrome Extension and local socket server

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall automatically registers first-party Chrome Native Messaging hosts and launcher scripts for the Mearl extension. That mutates a browser host control surface without a separate user command, but the origin is limited to this package's own extension ID.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installing @mearl/native-host with npm, which runs the postinstall script.

Impact

Chrome can later launch this package for the Mearl extension, after which the local socket, CDP, and agent-chat runtime become available.

Mechanism

First-party Chrome native messaging host registration at install time

AI rationale

Postinstall silently registers first-party Chrome Native Messaging hosts for the Mearl extension, which is install-time agent-extension setup rather than a foreign AI-agent hijack. Inspected source does not show install-time remote code execution, secret theft, or writes into third-party agent configs.

Evidence

package.jsondist/index.jsdist/install.jsLibrary/Application Support/Google/Chrome/NativeMessagingHosts/com.alibaba.mearl.skills.jsonLibrary/Application Support/Google/Chrome/NativeMessagingHosts/com.alibaba.mearl.mcp.json.config/google-chrome/NativeMessagingHosts/com.alibaba.mearl.skills.json.config/google-chrome/NativeMessagingHosts/com.alibaba.mearl.mcp.jsonC:\ProgramData\Google\Chrome\NativeMessagingHosts

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/index.js --init || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node dist/index.js --init || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` ... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node dist/index.js --init || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

38mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost();DEFAULT_EXTENSION_ID="aoehhjnofngknnje... L40: `))!==-1;)lines.push(this.buffer.slice(0,newlineIndex)),this.buffer=this.buffer.slice(newlineIndex+1);return{lines,overflow:!1}}};import http2 from"node:http";import WebSocket from... L41: `),encoded="";for(let n=0;n<str.length;n++){let c2=str.charCodeAt(n);c2<128?encoded+=String.fromCharCode(c2):c2<2048?(encoded+=String.fromCharCode(c2>>6|192),encoded+=String.fromCh...

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L38

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` L5: `+prefix),args.push(colorCode+"m+"+module.exports.humanize(this.diff)+"\x1B[0m")}else args[0]=getDate()+name+" "+args[0]}function getDate(){return exports.inspectOpts.hideDate?"":n... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return this.inspectOpts.colors

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

8"${nodePath}" "${hostPath}" %*\r L9: `;return fs17.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path17.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.stri... L10: `);return fs17.writeFileSync(launcherPath,content,"utf-8"),fs17.chmodSync(launcherPath,493),launcherPath}async function installNativeHost(options={}){let{mode="both",extensionId=DE... L11: Permission denied. Try running with sudo.`),!1}}async function uninstallNativeHost(options={},dependencies={}){return uninstallNativeHostArtifacts(options,dependencies)}async funct... ... L38: mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost(

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1

Source & flagged code

13 flagged

package.jsonView file

Lines 1-22json

1{

2 "name": "@mearl/native-host",

3 "version": "2.17.1",

4 "description": "Native Messaging Host for Mearl — bridges Chrome Extension and local socket server",

5 "type": "module",

6 "engines": {

7 "node": ">=22.12.0"

8 },

9 "main": "dist/install.js",

10 "types": "dist/install.d.ts",

11 "exports": {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

12 ".": {

13 "types": "./dist/install.d.ts",

14 "default": "./dist/install.js"

15 },

16 "./runtime": "./dist/index.js"

17 },

18 "bin": {

19 "mearl-native-host": "./dist/index.js"

20 },

21 "files": [

22 "dist/index.js",

Lines 34-56json

34 },

35 "dependencies": {

36 "ws": "^8.18.3"

37 },

38 "devDependencies": {

39 "@agentclientprotocol/sdk": "^1.2.1",

40 "@types/node": "^24.9.1",

41

dist/index.jsView file

38mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost();DEFAULT_EXTENSION_ID="aoehhjnofngknnje... L40: `))!==-1;)lines.push(this.buffer.slice(0,newlineIndex)),this.buffer=this.buffer.slice(newlineIndex+1);return{lines,overflow:!1}}};import http2 from"node:http";import WebSocket from... L41: `),encoded="";for(let n=0;n<str.length;n++){let c2=str.charCodeAt(n);c2<128?encoded+=String.fromCharCode(c2):c2<2048?(encoded+=String.fromCharCode(c2>>6|192),encoded+=String.fromCh...

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L38

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` L5: `+prefix),args.push(colorCode+"m+"+module.exports.humanize(this.diff)+"\x1B[0m")}else args[0]=getDate()+name+" "+args[0]}function getDate(){return exports.inspectOpts.hideDate?"":n... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return this.inspectOpts.colors

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

8"${nodePath}" "${hostPath}" %*\r L9: `;return fs17.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path17.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.stri... L10: `);return fs17.writeFileSync(launcherPath,content,"utf-8"),fs17.chmodSync(launcherPath,493),launcherPath}async function installNativeHost(options={}){let{mode="both",extensionId=DE... L11: Permission denied. Try running with sudo.`),!1}}async function uninstallNativeHost(options={},dependencies={}){return uninstallNativeHostArtifacts(options,dependencies)}async funct... ... L38: mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost(

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1