Loading npm security reports…

@mindflight/ghostcrab-personal-mcp@0.6.6: AI-agent | LPM Firewall

registry / @mindflight/ghostcrab-personal-mcp / 0.6.6

@mindflight/ghostcrab-personal-mcp@0.6.6

SQLite-backed MCP memory server (MindBrain + Zig backend), part of the MindBrain ecosystem.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes consumer-project files and existing user AI-agent configuration. It registers a Ghostcrab MCP server in Cursor and Codex configuration without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install runs postinstall when the native backend is available.

Impact

Consumer .env, data, documentation links, Cursor MCP configuration, and Codex configuration can be changed; future AI-agent sessions can start the package's MCP server.

Mechanism

Postinstall bootstrap and automatic MCP configuration rewrite.

Policy narrative

A registry install triggers postinstall. The script creates consumer-project files and symlinks, then automatically runs an upgrade with configuration cleanup enabled. That upgrade rewrites existing Cursor and Codex configuration, adding a Ghostcrab MCP server that invokes the package CLI. This is an unconsented install-time mutation of foreign AI-agent control surfaces.

AI rationale

The package performs automatic postinstall rewrites of user Cursor and Codex MCP settings, alongside broad consumer-project mutation. This meets the blocking policy for unconsented lifecycle mutation of AI-agent control surfaces.

Evidence

package.jsonbin/lib/postinstall-prebuilds.mjsbin/lib/postinstall-host-bootstrap.mjsbin/lib/install-upgrade.mjsconsumer project .envconsumer project data/consumer project README.md

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/lib/postinstall-prebuilds.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/lib/prebuild-permissions.mjsView file

11*/ L12: import { spawnSync } from "node:child_process"; L13: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/lib/prebuild-permissions.mjsView on unpkg · L11

bin/lib/install-upgrade.mjsView file

3import { L4: copyFileSync, L5: existsSync, L6: mkdirSync, L7: readFileSync, ... L9: unlinkSync, L10: writeFileSync L11: } from "node:fs"; ... L439: function copySqliteWithSidecars(dbPath, backupPath) { L440: mkdirSync(dirname(backupPath), { recursive: true }); L441: copyFileSync(dbPath, backupPath); L442: for (const suffix of ["-wal", "-shm"]) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/lib/install-upgrade.mjsView on unpkg · L3

471const ps = spawnSyncFn( L472: "powershell.exe", L473: [

High

Shell

Package source references shell execution.

bin/lib/install-upgrade.mjsView on unpkg · L471

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.8 matchedPath = bin/lib/install-upgrade.mjs matchedIdentity = npm:[redacted]:0.6.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/install-upgrade.mjsView on unpkg

bin/lib/sqlite-file-count.mjsView file

2L3: const require = createRequire(import.meta.url); L4: let cachedDatabaseSync = null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/sqlite-file-count.mjsView on unpkg · L2

dist/tools/business-query-learning/register-proposal.jsView file

245try { L246: const parsed = JSON.parse(value); L247: return parsed && typeof parsed === "object" && !Array.isArray(parsed)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/business-query-learning/register-proposal.jsView on unpkg · L245

bin/lib/path-shim.mjsView file

23Trigger-reachable persistence chain: scripts.postinstall -> bin/lib/postinstall-prebuilds.mjs -> bin/lib/path-shim.mjs L23: export function getGhostcrabBinDir() { L24: return join(homedir(), ".ghostcrab", "bin"); L25: } ... L35: /** L36: * @param {"sh" | "zsh" | "bash" | "fish" | "powershell"} shell L37: * @param {string} binDir ... L53: export function detectShellKind() { L54: if (process.platform === "win32") { L55: return "powershell"; L56: } L57: const shell = process.env.SHELL ?? ""; L58: if (shell.includes("fish")) return "fish";

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/lib/path-shim.mjsView on unpkg · L23

23export function getGhostcrabBinDir() { L24: return join(homedir(), ".ghostcrab", "bin"); L25: } ... L35: /** L36: * @param {"sh" | "zsh" | "bash" | "fish" | "powershell"} shell L37: * @param {string} binDir ... L53: export function detectShellKind() { L54: if (process.platform === "win32") { L55: return "powershell"; L56: } L57: const shell = process.env.SHELL ?? ""; L58: if (shell.includes("fish")) return "fish";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/path-shim.mjsView on unpkg · L23

bin/commands/serve.mjsView file

314} L315: mindbrainUrl ??= `http://127.0.0.1:${resolvedPort}`; L316: } ... L324: ); L325: const backendProcess = spawn(backendBin, [], { L326: env: { L327: ...process.env, L328: GHOSTCRAB_BACKEND_ADDR: backendAddr,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/commands/serve.mjsView on unpkg · L314

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.8 matchedPath = bin/commands/serve.mjs matchedIdentity = npm:[redacted]:0.6.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/commands/serve.mjsView on unpkg

bin/lib/mcp-permissions-adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. me( (name) => e.startswith(`${name}:`) || e === `${name}:*` ); }); } export function mergeclaudesettingspermissions(existing, patch, opts = {}) { const servernames = opts.servernames ?? [ "ghostcrab-personal-mcp", "ghostcrab" ]; const base = existing && typeof existing === "object" ? { ...existing } : {}; const permissions = base.permissions && typeof base.permissions === "object" ? { ... (base.permissions) }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/mcp-permissions-adapters.mjsView on unpkg

docs/installers/beta-bundle/MakefileView file

•path = docs/installers/beta-bundle/Makefile kind = build_helper sizeBytes = 5120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docs/installers/beta-bundle/MakefileView on unpkg

bin/lib/brain-engine-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.8 matchedPath = bin/lib/brain-engine-runner.mjs matchedIdentity = npm:[redacted]:0.6.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/brain-engine-runner.mjsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 43-83json

43 "installations",

44 "docs/index.md",

45 "docs/architecture",

46 "docs/dev",

47 "docs/installers",

48 "docs/posts/*.md",

49 "docs/reference",

50 "docs/setup",

51 "examples/ghostcrab-docs",

52 "examples/node-stdio-client",

53 "README.md",

54 "INSTALL.md",

55 "Licence.md",

56 ".env.example"

57 ],

58 "packageManager": "pnpm@10.10.0",

59 "engines": {

60 "node": ">=20.0.0"

61 },

62 "scripts": {

63 "postinstall": "node ./bin/lib/postinstall-prebuilds.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L63

64 "build": "tsc --project tsconfig.json && node scripts/copy-sql.mjs && node scripts/sync-ide-skill-bundles.mjs",

65 "sync:ide-skills": "node scripts/sync-ide-skill-bundles.mjs",

66 "clean": "rm -rf coverage dist",

67 "dev": "tsx src/index.ts",

68 "demo:load": "tsx src/cli/demo-load.ts",

69 "demo:load:immeuble": "tsx src/cli/demo-load.ts --profile-file examples/immeuble/contracts/answer_artifacts.seed.jsonl",

70 "backend:ensure-vendor": "scripts/ensure-vendor.sh",

71 "backend:sqlite3": "scripts/download-sqlite3.sh",

72 "backend:build": "sh scripts/backend-build-full.sh",

73 "prebuild:all": "sh scripts/prebuilds-all.sh",

74 "prebuild:local": "pnpm run prebuild:all",

75 "prebuild:stage-packages": "node scripts/stage-platform-packages.mjs",

76 "backend:build:debug": "cd cmd/backend && ZIG_LOCAL_CACHE_DIR=\"${ZIG_LOCAL_CACHE_DIR:-/tmp/ghostcrab-zig-local-cache}\" ZIG_GLOBAL_CACHE_DIR=\"${ZIG_GLOBAL_CACHE_DIR:-/tmp/ghostcrab-zig-global-cache}\" \"${ZIG:-zig}\" build",

77 "backend:dev": "GHOSTCRAB_BACKEND_ADDR=:8091 GHOSTCRAB_SQLITE_PATH=data/ghostcrab.sqlite cmd/backend/zig-out/bin/ghostcrab-backend",

78 "smoke:backend": "scripts/smoke-backend.sh",

79 "embeddings:backfill": "tsx src/cli/embeddings-backfill.ts",

80 "format": "prettier --write .",

81 "format:check": "prettier --check .",

82 "lint": "eslint .",

83 "migrate": "tsx src/cli/migrate.ts",

bin/lib/prebuild-permissions.mjsView file

Lines 1-31javascript

1/**

2 * Cross-platform prep for the native backend.

3 *

4 * Resolution order:

5 * - platform optionalDependency package when installed

6 * - local prebuilds/{platform-key}/ fallback for dev builds

7 *

8 * - Linux / macOS: ensure POSIX execute bit (npm/pnpm often strip +x on unpack).

9 * - macOS: try to clear Gatekeeper quarantine (downloaded / browser-copied toolchains).

10 * - Windows: .exe is run directly; no chmod (nothing to do here).

bin/lib/install-upgrade.mjsView file

Lines 1-23javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import {

4 copyFileSync,

5 existsSync,

6 mkdirSync,

7 readFileSync,

bin/lib/sqlite-file-count.mjsView file

Lines 1-22javascript

1import { createRequire } from "node:module";

2

3const require = createRequire(import.meta.url);

4let cachedDatabaseSync = null;

dist/tools/business-query-learning/register-proposal.jsView file

Lines 225-256javascript

225 AND (

226 json_extract(facets_json, '$.capability_id') = ?

227 OR json_extract(facets_json, '$.proposal_fingerprint') = ?

228 )

bin/lib/path-shim.mjsView file

Lines 3-43javascript

3 * Installs a wrapper under ~/.ghostcrab/bin (or %USERPROFILE%\.ghostcrab\bin).

4 */

5import {

6 appendFileSync,

7 chmodSync,

8 existsSync,

9

bin/commands/serve.mjsView file

Lines 294-334javascript

294 }

295 }

296 } catch {

297 /* unreadable PID file, ignore */

298 }

299 }

300

301 // ── Port selection (only when not reusing an existing backend) ────────────

302 if (!

bin/lib/mcp-permissions-adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. me( (name) => e.startswith(`${name}:`) || e === `${name}:*` ); }); } export function mergeclaudesettingspermissions(existing, patch, opts = {}) { const servernames = opts.servernames ?? [ "ghostcrab-personal-mcp", "ghostcrab" ]; const base = existing && typeof existing === "object" ? { ...existing } : {}; const permissions = base.permissions && typeof base.permissions === "object" ? { ... (base.permissions) }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/mcp-permissions-adapters.mjsView on unpkg

docs/installers/beta-bundle/MakefileView file

•path = docs/installers/beta-bundle/Makefile kind = build_helper sizeBytes = 5120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docs/installers/beta-bundle/MakefileView on unpkg

bin/lib/brain-engine-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.8 matchedPath = bin/lib/brain-engine-runner.mjs matchedIdentity = npm:[redacted]:0.6.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/brain-engine-runner.mjsView on unpkg