registry / @modootoday/datalab-extension-mcp / 0.0.4

@modootoday/datalab-extension-mcp@0.0.4

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `datalab-extension-mcp install` (optionally with `--yes`) or starts the CLI with required environment variables.

Impact

Configured AI hosts can launch this package and pass MCP requests to the connected browser extension.

Mechanism

Explicit AI-agent MCP registration plus authenticated loopback bridge.

Rationale

Source inspection found an explicit, consented AI-agent configuration capability but no concrete malicious chain. Per policy, this is a warn-level agent capability risk rather than a publish-block attack.

Evidence

package.jsondist/cli.jsdist/dist-WDYJQJBK.jsdist/chunk-DXIOXXJK.js~/Library/Application Support/Claude/claude_desktop_config.json~/.cursor/mcp.json

Network endpoints1

127.0.0.1:8765

Decision evidence

public snapshot

@modootoday/datalab-extension-mcp@0.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code