Loading npm security reports…

@mindflight/ghostcrab-personal-mcp@0.6.8: AI-agent | LPM Firewall

registry / @mindflight/ghostcrab-personal-mcp / 0.6.8

@mindflight/ghostcrab-personal-mcp@0.6.8

SQLite-backed MCP memory server (MindBrain + Zig backend), part of the MindBrain ecosystem.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a postinstall script that modifies the consumer project and registers this package as an MCP server in existing Cursor and Codex configurations. The registration makes the package command available to those agent clients without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation when the native backend is available and opt-out environment variables are absent.

Impact

Consumer project files and broad AI-agent control surfaces can be altered, causing Cursor or Codex to launch the package server.

Mechanism

Postinstall bootstrap and automatic MCP configuration rewrite.

Policy narrative

On npm install, the lifecycle hook bootstraps files and links in the consuming project. When its native backend is available, it automatically runs an upgrade routine with configuration cleanup enabled. That routine replaces the package's MCP entries in Cursor and Codex configuration and adds a server command pointing at the installed package. This is an unconsented install-time mutation of external AI-agent control surfaces.

AI rationale

The automatic postinstall chain writes consumer-project files and registers an MCP server in Cursor and Codex configuration. This is concrete install-hook abuse even though the inspected path did not show external exfiltration.

Evidence

bin/lib/postinstall-prebuilds.mjsbin/lib/install-upgrade.mjsbin/lib/postinstall-host-bootstrap.mjsconsumer project/.env

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/lib/postinstall-prebuilds.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/lib/prebuild-permissions.mjsView file

11*/ L12: import { spawnSync } from "node:child_process"; L13: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/lib/prebuild-permissions.mjsView on unpkg · L11

bin/lib/install-upgrade.mjsView file

3import { L4: copyFileSync, L5: existsSync, L6: mkdirSync, L7: readFileSync, ... L9: unlinkSync, L10: writeFileSync L11: } from "node:fs"; ... L439: function copySqliteWithSidecars(dbPath, backupPath) { L440: mkdirSync(dirname(backupPath), { recursive: true }); L441: copyFileSync(dbPath, backupPath); L442: for (const suffix of ["-wal", "-shm"]) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/lib/install-upgrade.mjsView on unpkg · L3

471const ps = spawnSyncFn( L472: "powershell.exe", L473: [

High

Shell

Package source references shell execution.

bin/lib/install-upgrade.mjsView on unpkg · L471

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.7 matchedPath = bin/lib/install-upgrade.mjs matchedIdentity = npm:[redacted]:0.6.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/install-upgrade.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 3bd8c3a215d1ba32 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.7 matchedPath = bin/lib/install-upgrade.mjs matchedIdentity = npm:[redacted]:0.6.7 similarity = 1.000 shingleOverlap = 71 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/lib/install-upgrade.mjsView on unpkg

bin/lib/sqlite-file-count.mjsView file

2L3: const require = createRequire(import.meta.url); L4: let cachedDatabaseSync = null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/sqlite-file-count.mjsView on unpkg · L2

dist/tools/business-query-learning/register-proposal.jsView file

245try { L246: const parsed = JSON.parse(value); L247: return parsed && typeof parsed === "object" && !Array.isArray(parsed)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/business-query-learning/register-proposal.jsView on unpkg · L245

bin/lib/path-shim.mjsView file

23Trigger-reachable persistence chain: scripts.postinstall -> bin/lib/postinstall-prebuilds.mjs -> bin/lib/path-shim.mjs L23: export function getGhostcrabBinDir() { L24: return join(homedir(), ".ghostcrab", "bin"); L25: } ... L35: /** L36: * @param {"sh" | "zsh" | "bash" | "fish" | "powershell"} shell L37: * @param {string} binDir ... L53: export function detectShellKind() { L54: if (process.platform === "win32") { L55: return "powershell"; L56: } L57: const shell = process.env.SHELL ?? ""; L58: if (shell.includes("fish")) return "fish";

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/lib/path-shim.mjsView on unpkg · L23

23export function getGhostcrabBinDir() { L24: return join(homedir(), ".ghostcrab", "bin"); L25: } ... L35: /** L36: * @param {"sh" | "zsh" | "bash" | "fish" | "powershell"} shell L37: * @param {string} binDir ... L53: export function detectShellKind() { L54: if (process.platform === "win32") { L55: return "powershell"; L56: } L57: const shell = process.env.SHELL ?? ""; L58: if (shell.includes("fish")) return "fish";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/path-shim.mjsView on unpkg · L23

bin/commands/serve.mjsView file

314} L315: mindbrainUrl ??= `http://127.0.0.1:${resolvedPort}`; L316: } ... L324: ); L325: const backendProcess = spawn(backendBin, [], { L326: env: { L327: ...process.env, L328: GHOSTCRAB_BACKEND_ADDR: backendAddr,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/commands/serve.mjsView on unpkg · L314

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.7 matchedPath = bin/commands/serve.mjs matchedIdentity = npm:[redacted]:0.6.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/commands/serve.mjsView on unpkg

bin/lib/mcp-permissions-adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. me( (name) => e.startswith(`${name}:`) || e === `${name}:*` ); }); } export function mergeclaudesettingspermissions(existing, patch, opts = {}) { const servernames = opts.servernames ?? [ "ghostcrab-personal-mcp", "ghostcrab" ]; const base = existing && typeof existing === "object" ? { ...existing } : {}; const permissions = base.permissions && typeof base.permissions === "object" ? { ... (base.permissions) }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/mcp-permissions-adapters.mjsView on unpkg

docs/installers/beta-bundle/MakefileView file

•path = docs/installers/beta-bundle/Makefile kind = build_helper sizeBytes = 5120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docs/installers/beta-bundle/MakefileView on unpkg

bin/lib/brain-engine-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.7 matchedPath = bin/lib/brain-engine-runner.mjs matchedIdentity = npm:[redacted]:0.6.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/brain-engine-runner.mjsView on unpkg

bin/lib/mcp-global-setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.7 matchedPath = bin/lib/mcp-global-setup.mjs matchedIdentity = npm:[redacted]:0.6.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/mcp-global-setup.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.5 matchedIdentity = npm:[redacted]:0.6.5 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/mcp-global-setup.mjsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 43-83json

43 "installations",

44 "docs/index.md",

45 "docs/architecture",

46 "docs/dev",

47 "docs/installers",

48 "docs/posts/*.md",

49 "docs/reference",

50 "docs/setup",

51 "examples/ghostcrab-docs",

52 "examples/node-stdio-client",

53 "README.md",

54 "INSTALL.md",

55 "Licence.md",

56 ".env.example"

57 ],

58 "packageManager": "pnpm@10.10.0",

59 "engines": {

60 "node": ">=20.0.0"

61 },

62 "scripts": {

63 "postinstall": "node ./bin/lib/postinstall-prebuilds.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L63

64 "build": "tsc --project tsconfig.json && node scripts/copy-sql.mjs && node scripts/sync-ide-skill-bundles.mjs",

65 "sync:ide-skills": "node scripts/sync-ide-skill-bundles.mjs",

66 "clean": "rm -rf coverage dist",

67 "dev": "tsx src/index.ts",

68 "demo:load": "tsx src/cli/demo-load.ts",

69 "demo:load:immeuble": "tsx src/cli/demo-load.ts --profile-file examples/immeuble/contracts/answer_artifacts.seed.jsonl",

70 "backend:ensure-vendor": "scripts/ensure-vendor.sh",

71 "backend:sqlite3": "scripts/download-sqlite3.sh",

72 "backend:build": "sh scripts/backend-build-full.sh",

73 "prebuild:all": "sh scripts/prebuilds-all.sh",

74 "prebuild:local": "pnpm run prebuild:all",

75 "prebuild:stage-packages": "node scripts/stage-platform-packages.mjs",

76 "backend:build:debug": "cd cmd/backend && ZIG_LOCAL_CACHE_DIR=\"${ZIG_LOCAL_CACHE_DIR:-/tmp/ghostcrab-zig-local-cache}\" ZIG_GLOBAL_CACHE_DIR=\"${ZIG_GLOBAL_CACHE_DIR:-/tmp/ghostcrab-zig-global-cache}\" \"${ZIG:-zig}\" build",

77 "backend:dev": "GHOSTCRAB_BACKEND_ADDR=:8091 GHOSTCRAB_SQLITE_PATH=data/ghostcrab.sqlite cmd/backend/zig-out/bin/ghostcrab-backend",

78 "smoke:backend": "scripts/smoke-backend.sh",

79 "embeddings:backfill": "tsx src/cli/embeddings-backfill.ts",

80 "format": "prettier --write .",

81 "format:check": "prettier --check .",

82 "lint": "eslint .",

83 "migrate": "tsx src/cli/migrate.ts",

bin/lib/prebuild-permissions.mjsView file

Lines 1-31javascript

1/**

2 * Cross-platform prep for the native backend.

3 *

4 * Resolution order:

5 * - platform optionalDependency package when installed

6 * - local prebuilds/{platform-key}/ fallback for dev builds

7 *

8 * - Linux / macOS: ensure POSIX execute bit (npm/pnpm often strip +x on unpack).

9 * - macOS: try to clear Gatekeeper quarantine (downloaded / browser-copied toolchains).

10 * - Windows: .exe is run directly; no chmod (nothing to do here).

bin/lib/install-upgrade.mjsView file

Lines 1-23javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import {

4 copyFileSync,

5 existsSync,

6 mkdirSync,

7 readFileSync,

bin/lib/sqlite-file-count.mjsView file

Lines 1-22javascript

1import { createRequire } from "node:module";

2

3const require = createRequire(import.meta.url);

4let cachedDatabaseSync = null;

dist/tools/business-query-learning/register-proposal.jsView file

Lines 225-256javascript

225 AND (

226 json_extract(facets_json, '$.capability_id') = ?

227 OR json_extract(facets_json, '$.proposal_fingerprint') = ?

228 )

bin/lib/path-shim.mjsView file

Lines 3-43javascript

3 * Installs a wrapper under ~/.ghostcrab/bin (or %USERPROFILE%\.ghostcrab\bin).

4 */

5import {

6 appendFileSync,

7 chmodSync,

8 existsSync,

9

bin/commands/serve.mjsView file

Lines 294-334javascript

294 }

295 }

296 } catch {

297 /* unreadable PID file, ignore */

298 }

299 }

300

301 // ── Port selection (only when not reusing an existing backend) ────────────

302 if (!

bin/lib/mcp-permissions-adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. me( (name) => e.startswith(`${name}:`) || e === `${name}:*` ); }); } export function mergeclaudesettingspermissions(existing, patch, opts = {}) { const servernames = opts.servernames ?? [ "ghostcrab-personal-mcp", "ghostcrab" ]; const base = existing && typeof existing === "object" ? { ...existing } : {}; const permissions = base.permissions && typeof base.permissions === "object" ? { ... (base.permissions) }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/mcp-permissions-adapters.mjsView on unpkg

docs/installers/beta-bundle/MakefileView file

•path = docs/installers/beta-bundle/Makefile kind = build_helper sizeBytes = 5120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docs/installers/beta-bundle/MakefileView on unpkg

bin/lib/brain-engine-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.7 matchedPath = bin/lib/brain-engine-runner.mjs matchedIdentity = npm:[redacted]:0.6.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/brain-engine-runner.mjsView on unpkg

bin/lib/mcp-global-setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.7 matchedPath = bin/lib/mcp-global-setup.mjs matchedIdentity = npm:[redacted]:0.6.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/mcp-global-setup.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.5 matchedIdentity = npm:[redacted]:0.6.5 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/mcp-global-setup.mjsView on unpkg