Loading npm security reports…

@mrrlin-dev/mcp@0.4.87: Suspicious npm security report (Warn) | LPM Firewall

registry / @mrrlin-dev/mcp / 0.4.87

@mrrlin-dev/mcp@0.4.87

CLI that runs the local Director bridge under PM2 and forwards chat turns to a locally-spawned Codex `app-server`. Installed globally on operator boxes via `npm install -g @mrrlin-dev/mcp` (the official install path; `pnpm install -g` also works if the op

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install -g runs the postinstall signal. mrrlin-mcp configure bridge, or an install-public-mcp-server message on the token-gated local bridge socket, writes the agent configs.

Impact

A global install can interrupt the vendor bridge so it restarts. A paired local client or the configure command can add executable MCP server entries to the operator's agent configs.

Mechanism

postinstall calls pm2 jlist and process.kill with SIGUSR2 for matching online processes. installPublicMcpServerToConfigs updates ~/.claude.json, ~/.codex/config.toml, and the Antigravity mcp_config.json with the supplied server command.

AI rationale

The install hook only signals this package's own PM2 bridge and does not rewrite foreign agent configs. Agent-config writes are a first-party capability reached by the explicit configure command or a token-gated local bridge message, so they warrant a warning rather than a publish block.

Evidence

package.jsonscripts/postinstall-restart.cjsdist/bin.cjs~/.claude.json~/.codex/config.toml~/.gemini/antigravity/mcp_config.json

Network endpoints2

api.mrrlin.com

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-restart.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/bin.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mrrlin-dev/mcp@0.4.80 matchedIdentity = npm:QG1ycmxpbi1kZXYvbWNw:0.4.80 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.cjsView on unpkg

21161var import_node_path41 = __toESM(require("node:path"), 1); L21162: var import_node_child_process21 = require("node:child_process"); L21163: var import_node_fs25 = require("node:fs");

High

Child Process

Package source references child process execution.

dist/bin.cjsView on unpkg · L21161

41802env: config2?.env ?? process.env, L41803: shell: true L41804: });

High

Shell

Package source references shell execution.

dist/bin.cjsView on unpkg · L41802

55471// src/agent-version.ts L55472: var import_node_child_process12 = require("node:child_process"); L55473: var import_semver = __toESM(require_semver2(), 1); L55474: var SEMVER_RE = /\b\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?\b/; L55475: var CODEX_PACKAGE = process.env.MRRLIN_CODEX_PACKAGE?.trim() || "@openai/codex"; L55476: var distTagsUrl = (pkg) => `https://registry.npmjs.org/-/package/${encodeURIComponent(pkg)}/dist-tags`; L55477: function parseCodexVersion(raw) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin.cjsView on unpkg · L55471

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin.cjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); var fs$writeFile = fs15.writeFile; fs15.writeFile = writeFile5; function writeFile5(path28, data, options, cb) { return go$writeFile(path28, data, options, cb); function go$writeFile(path29, data2, options2, cb2, startTime) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.cjsView on unpkg

420try { L421: const utilInspect = eval("require('util').inspect"); L422: _custom = utilInspect.custom; ... L1623: if (global.Buffer && global.Buffer.isBuffer(str)) { L1624: str = str.toString("utf8"); L1625: } ... L3224: // validation function arguments L3225: data: new codegen_1.Name("data"), L3226: // data passed to validation function ... L4251: id = normalizeId(id); L4252: return resolver.resolve(baseId, id); L4253: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.cjsView on unpkg · L420

15395if (!fs14[gracefulQueue]) { L15396: queue = global[gracefulQueue] || []; L15397: publishQueue(fs14, queue);

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bin.cjsView on unpkg · L15395

420try { L421: const utilInspect = eval("require('util').inspect"); L422: _custom = utilInspect.custom;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bin.cjsView on unpkg · L420

420try { L421: const utilInspect = eval("require('util').inspect"); L422: _custom = utilInspect.custom; ... L1623: if (global.Buffer && global.Buffer.isBuffer(str)) { L1624: str = str.toString("utf8"); L1625: } ... L3224: // validation function arguments L3225: data: new codegen_1.Name("data"), L3226: // data passed to validation function ... L4251: id = normalizeId(id); L4252: return resolver.resolve(baseId, id); L4253: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/bin.cjsView on unpkg · L420

scripts/postinstall-restart.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/postinstall-restart.cjs#virtual:normalized:round1View on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 35-61json

35 "@types/proper-lockfile": "^4.1.4",

36 "@types/qrcode": "^1.5.5",

37 "@types/qrcode-terminal": "^0.12.2",

38 "@types/semver": "^7.5.8",

39 "@types/ws": "^8.5.12",

40 "esbuild": "^0.24.2",

41 "tsx": "^4.19.1",

42 "typescript": "^5.5.4",

43 "@mrrlin/agent-client": "0.0.0",

44 "@mrrlin/client": "0.0.0",

45 "@mrrlin/director-e2e": "0.0.0",

46 "@mrrlin/schemas": "0.0.0",

47 "@mrrlin/tsconfig": "0.0.0",

48 "@mrrlin/wiki": "0.0.0"

49 },

50 "scripts": {

51 "build": "node scripts/write-version.mjs && tsc -p tsconfig.json && pnpm run bundle && chmod +x dist/bin.cjs",

52 "bundle": "node scripts/write-version.mjs && esbuild src/bin.ts --bundle --platform=node --format=cjs --target=node20 --outfile=dist/bin.cjs --banner:js='#!/usr/bin/env node' && mkdir -p dist/consensus/personas && cp src/consensus/personas/*.md dist/consensus/personas/",

53 "dev": "tsx watch src/bin.ts serve",

54 "lint": "eslint .",

55 "postinstall": "node scripts/postinstall-restart.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

56 "start": "node dist/bin.cjs serve",

57 "test": "pnpm --filter @mrrlin/agent-client build && node scripts/write-version.mjs && node --import tsx --test $(find src -name '*.test.ts' | sort | tr '\\n' ' ')",

58 "test:watch": "node --import tsx --test --watch src/**/*.test.ts",

59 "typecheck": "node scripts/write-version.mjs && pnpm --filter @mrrlin/schemas build && pnpm --filter @mrrlin/client build && pnpm --filter @mrrlin/wiki build && pnpm --filter @mrrlin/agent-client build && pnpm --filter @mrrlin/director-e2e build && tsc -p tsconfig.json --noEmit"

60 }

61}

dist/bin.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mrrlin-dev/mcp@0.4.80 matchedIdentity = npm:QG1ycmxpbi1kZXYvbWNw:0.4.80 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.cjsView on unpkg

21161var import_node_path41 = __toESM(require("node:path"), 1); L21162: var import_node_child_process21 = require("node:child_process"); L21163: var import_node_fs25 = require("node:fs");

High

Child Process

Package source references child process execution.

dist/bin.cjsView on unpkg · L21161

41802env: config2?.env ?? process.env, L41803: shell: true L41804: });

High

Shell

Package source references shell execution.

dist/bin.cjsView on unpkg · L41802

55471// src/agent-version.ts L55472: var import_node_child_process12 = require("node:child_process"); L55473: var import_semver = __toESM(require_semver2(), 1); L55474: var SEMVER_RE = /\b\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?\b/; L55475: var CODEX_PACKAGE = process.env.MRRLIN_CODEX_PACKAGE?.trim() || "@openai/codex"; L55476: var distTagsUrl = (pkg) => `https://registry.npmjs.org/-/package/${encodeURIComponent(pkg)}/dist-tags`; L55477: function parseCodexVersion(raw) {

scripts/postinstall-restart.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/postinstall-restart.cjs#virtual:normalized:round1View on unpkg