registry / AI-agent control-surface risk / @myelixlabs/synapse-mcp
@myelixlabs/synapse-mcp
Cuts AI token costs, eliminates hallucinated refactors and answers in <2ms — AST code-knowledge graph for Cursor, Claude Code, Windsurf, Warp, Continue & Zed. Runs fully local.
This report shows the evidence for @myelixlabs/synapse-mcp@3.6.3. 9 of 16 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource directly establishes both remote binary execution and silent mutation of multiple third-party/global AI-agent instruction files during postinstall. This meets the block policy regardless of the scanner similarity hint.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm installation invokes `node bin/synapse-mcp.js install --quiet`
Impact
Remote executable code runs during installation and future agent behavior can be redirected across installed AI tools.
Mechanism
unsigned remote binary execution plus unconsented broad AI-agent control-surface mutation
Policy narrative
Installing the package invokes its quiet installer. That installer downloads a platform launcher from the vendor CDN, executes it, and for this pinned release does not authenticate the downloaded artifact. It then silently appends a policy to existing AI-agent control files that requires Synapse-first discovery and tells agents not to use normal shell or filesystem inspection. This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces.
AI rationale
Source directly establishes both remote binary execution and silent mutation of multiple third-party/global AI-agent instruction files during postinstall. This meets the block policy regardless of the scanner similarity hint.
Evidence
package.jsonbin/synapse-mcp.jslib/install.jslib/agent-rules.js~/.synapse-mcp/synapse-mcp~/.gemini/config/AGENTS.md~/.claude/CLAUDE.md~/.cursorrules~/.windsurfrules~/.clinerules
Network endpoints1
downloads.synapse-mcp.dev/synapse-mcp/3.6.3/
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall automatically.
- lib/install.js downloads a platform binary into ~/.synapse-mcp.
- lib/install.js executes the downloaded binary with --version.
- Pinned 3.6.3 downloads lack a SHA-256/signature check.
- postinstall appends MCP-first instructions to detected Gemini, Claude, Cursor, Windsurf, and Cline control files.
- Injected policy directs agents away from shell/file discovery toward Synapse.
Evidence against
- Node auth flow uses explicit device-code sign-in and stores credentials locally.
- The Node dashboard binds to 127.0.0.1.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8scripts.postinstall = node bin/synapse-mcp.js install --quiet || true
Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution.
L8: * → launcher installed + service running → show status
L9: * → launcher installed + service stopped → offer to start
L10: * → not installed → run full wizard
...
L14: * install --quiet → silent install (CI / postinstall)
L15: * start → service.start()
L16: * stop → service.stop()
L17: * restart → service.restart()
L18: * status → service.status()
...
L29: * repos reindex → repos.reindex()
L30: * ui → startDashboard() + open browser
L31: *
...
L37: * The
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L8•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/synapse-mcp.jsView file
45const os = require('node:os');
L46: const childProcess = require('node:child_process');
L47:
High
Child Process
Package source references child process execution.
bin/synapse-mcp.jsView on unpkg · L4545const os = require('node:os');
L46: const childProcess = require('node:child_process');
L47:
...
L49:
L50: const PROD_API_BASE = 'https://api.synapse-mcp.dev';
L51: const DEFAULT_API_BASE =
L52: (process.env.SYNAPSE_API_URL || process.env.SYNAPSE_MCP_API_BASE || PROD_API_BASE)
L53: .replace(/\/+$/, '');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/synapse-mcp.jsView on unpkg · L45•matchType = normalized_sha256
matchedPackage = @myelixlabs/synapse-mcp@3.3.0
matchedPath = bin/synapse-mcp.js
matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.3.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/synapse-mcp.jsView on unpkgbin/synapse-mcp.js#virtual:normalized:round1View file
614probePort: async (port) => {
L615: const http = require("node:http");
L616: return new Promise((resolve) => {
...
L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); });
L623: req.end();
L624: });
L625: },
L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy...
L627: setImmediate(async () => {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614614Trigger-reachable command-output exfiltration chain: scripts.postinstall -> bin/synapse-mcp.js
L614: probePort: async (port) => {
L615: const http = require("node:http");
L616: return new Promise((resolve) => {
...
L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); });
L623: req.end();
L624: });
L625: },
L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy...
L627: setImmediate(async () => {
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614lib/service.jsView file
25const os = require('node:os');
L26: const childProcess = require('node:child_process');
L27: const http = require('node:http');
L28:
...
L43:
L44: function homeDir() {
L45: return process.env.HOME || process.env.USERPROFILE || os.homedir();
L46: }
...
L63:
L64: function stdoutLog(installDir) {
L65: return path.join(logDir(installDir), 'stdout.log');
...
L72: function launcherPath(installDir) {
Critical
Download Execute
Source downloads or fetches remote code and executes it.
lib/service.jsView on unpkg · L25•matchType = normalized_sha256
matchedPackage = @myelixlabs/synapse-mcp@3.3.0
matchedPath = lib/service.js
matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.3.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/service.jsView on unpkglib/install.jsView file
251Install-time code directly mutates a foreign AI-agent control surface:
L251: const buf = Buffer.from(await res.arrayBuffer());
L252: fs.writeFileSync(tmp, buf);
L253: if (process.platform !== 'win32') fs.chmodSync(tmp, 0o755);
...
L305:
L306: fs.mkdirSync(installDir, { recursive: true });
L307:
...
L379: const ruleTargets = [
L380: { path: require('path').join(homedir, '.gemini', 'config', 'AGENTS.md'), dirOnly: true },
L381: { path: require('path').join(homedir, '.claude', 'CLAUDE.md'), dirOnly: true },
L382: { path: require('path').join(homedir, '.cursorrules'), parentDir: require('path').join(homedir, '.cursor') },
L383: { path: require('path').join(homedir, '.windsurfrules'), parentDir: require('path').join(homedir, '.codeium', 'windsurf') },
L384: { path: require('path').join(homedi
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
lib/install.jsView on unpkg · L251•matchType = normalized_sha256
matchedPackage = @myelixlabs/synapse-mcp@3.3.0
matchedPath = lib/install.js
matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.3.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/install.jsView on unpkglib/server.jsView file
•matchType = normalized_sha256
matchedPackage = @myelixlabs/synapse-mcp@3.6.2
matchedPath = lib/server.js
matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.6.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server.jsView on unpkglib/auth.jsView file
•matchType = normalized_sha256
matchedPackage = @myelixlabs/synapse-mcp@3.6.2
matchedPath = lib/auth.js
matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.6.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/auth.jsView on unpkgFindings
2 Critical12 High4 Medium4 Low
CriticalDownload Executelib/service.js
CriticalAi Agent Control Hijacklib/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/synapse-mcp.js
HighShell
HighSame File Env Network Executionbin/synapse-mcp.js
HighCommand Output Exfiltrationbin/synapse-mcp.js#virtual:normalized:round1
HighUnverified Remote Native Payload Installpackage.json
HighTrigger Reachable Command Output Exfiltrationbin/synapse-mcp.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/synapse-mcp.js
HighKnown Malware Source Similaritylib/server.js
HighKnown Malware Source Similaritylib/service.js
HighKnown Malware Source Similaritylib/auth.js
HighKnown Malware Source Similaritylib/install.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @myelixlabs/synapse-mcp@3.6.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing @myelixlabs/synapse-mcp@3.6.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
16 known versions3.6.3latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 9, 2026, 5:37 PM3.6.2MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 7, 2026, 10:08 PM3.5.1MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 7, 2026, 1:21 AM3.4.0MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 5, 2026, 7:34 PM3.3.0MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 5, 2026, 3:52 AM3.1.0MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 4, 2026, 8:11 PM3.0.7MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 30, 2026, 5:09 PM3.0.6MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 30, 2026, 1:13 PM3.0.4MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 30, 2026, 12:39 PM0.0.0-v3-0-0rc4Suspicious—WarnPublishedJul 18, 2026, 7:12 PM0.0.0-v3-0-0rc3Suspicious—WarnPublishedJul 17, 2026, 8:52 PM0.0.0-v3-0-0rc2Suspicious—WarnPublishedJul 17, 2026, 1:57 PM0.0.0-v3-0-0rc1Suspicious—WarnPublishedJul 16, 2026, 5:01 PM0.0.0-v2-1-34rc1Suspicious—WarnPublishedJul 10, 2026, 1:25 PM0.1.2-pocSuspicious—WarnPublishedJul 1, 2026, 2:02 PM0.1.0-pocSuspicious—WarnPublishedJun 30, 2026, 1:44 PM