registry / AI-agent control-surface risk / @myelixlabs/synapse-mcp

@myelixlabs/synapse-mcp

Cuts AI token costs, eliminates hallucinated refactors and answers in <2ms — AST code-knowledge graph for Cursor, Claude Code, Windsurf, Warp, Continue & Zed. Runs fully local.

This report shows the evidence for @myelixlabs/synapse-mcp@3.6.3. 9 of 16 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source directly establishes both remote binary execution and silent mutation of multiple third-party/global AI-agent instruction files during postinstall. This meets the block policy regardless of the scanner similarity hint.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation invokes `node bin/synapse-mcp.js install --quiet`

Impact

Remote executable code runs during installation and future agent behavior can be redirected across installed AI tools.

Mechanism

unsigned remote binary execution plus unconsented broad AI-agent control-surface mutation

Policy narrative

Installing the package invokes its quiet installer. That installer downloads a platform launcher from the vendor CDN, executes it, and for this pinned release does not authenticate the downloaded artifact. It then silently appends a policy to existing AI-agent control files that requires Synapse-first discovery and tells agents not to use normal shell or filesystem inspection. This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces.

AI rationale

Evidence

package.jsonbin/synapse-mcp.jslib/install.jslib/agent-rules.js~/.synapse-mcp/synapse-mcp~/.gemini/config/AGENTS.md~/.claude/CLAUDE.md~/.cursorrules~/.windsurfrules~/.clinerules

Network endpoints1

downloads.synapse-mcp.dev/synapse-mcp/3.6.3/

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall automatically.
lib/install.js downloads a platform binary into ~/.synapse-mcp.
lib/install.js executes the downloaded binary with --version.
Pinned 3.6.3 downloads lack a SHA-256/signature check.
postinstall appends MCP-first instructions to detected Gemini, Claude, Cursor, Windsurf, and Cline control files.
Injected policy directs agents away from shell/file discovery toward Synapse.

Evidence against

Node auth flow uses explicit device-code sign-in and stores credentials locally.
The Node dashboard binds to 127.0.0.1.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 320 KB of source, external domains: 127.0.0.1, api.synapse-mcp.dev, downloads.synapse-mcp.dev, synapse-mcp.dev, www.apple.com

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8scripts.postinstall = node bin/synapse-mcp.js install --quiet || true Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L8: * → launcher installed + service running → show status L9: * → launcher installed + service stopped → offer to start L10: * → not installed → run full wizard ... L14: * install --quiet → silent install (CI / postinstall) L15: * start → service.start() L16: * stop → service.stop() L17: * restart → service.restart() L18: * status → service.status() ... L29: * repos reindex → repos.reindex() L30: * ui → startDashboard() + open browser L31: * ... L37: * The

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L8

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

Lines 25-65javascript

25 * repos add → repos.add()

26 * repos archive → repos.archive()

27 * repos restore → repos.restore()

28 * repos remove → repos.remove()

29 *

bin/synapse-mcp.js#virtual:normalized:round1View file

614probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

614Trigger-reachable command-output exfiltration chain: scripts.postinstall -> bin/synapse-mcp.js L614: probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

lib/service.jsView file

Lines 5-45javascript

5 *

6 * Responsibilities:

7 * start() — spawn launcher with --http --port <port>, detach, write PID file,

lib/install.jsView file

Lines 231-271javascript

231

232/**

233 * Download a launcher binary via Node's built-in fetch.

234 *

235 * Why fetch (not curl): CI images like node:20-slim and many minimal

236 * environments do not ship curl. Node >=18 (our engines floor) provides

237 * fetch, so we avoid an external binary dependency for postinstall.

238 */

239async function downloadArtifact(url

lib/server.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.6.2 matchedPath = lib/server.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/server.jsView on unpkg

lib/auth.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.6.2 matchedPath = lib/auth.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L8

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Findings

2 Critical12 High4 Medium4 Low

CriticalDownload Executelib/service.js

CriticalAi Agent Control Hijacklib/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/synapse-mcp.js

HighShell

HighSame File Env Network Executionbin/synapse-mcp.js

HighCommand Output Exfiltrationbin/synapse-mcp.js#virtual:normalized:round1

HighUnverified Remote Native Payload Installpackage.json

HighTrigger Reachable Command Output Exfiltrationbin/synapse-mcp.js#virtual:normalized:round1

HighKnown Malware Source Similaritybin/synapse-mcp.js

HighKnown Malware Source Similaritylib/server.js

Affected versions and remediation

This report applies to @myelixlabs/synapse-mcp@3.6.3.

The versions list below shows the verdict for each recorded version.

Avoid installing @myelixlabs/synapse-mcp@3.6.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-09 17:42:16.269Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

16 known versions

3.6.3latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 9, 2026, 5:37 PM 3.6.2MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 7, 2026, 10:08 PM 3.5.1MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 7, 2026, 1:21 AM 3.4.0MaliciousSoft block: AI-agent control surfaceBlock

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code