registry / @myelixlabs/synapse-mcp / 0.0.0-v2-1-34rc1

@myelixlabs/synapse-mcp@0.0.0-v2-1-34rc1

Installer/launcher shim for Synapse MCP.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

UrlStrings

Manifest

NoLicense

scanned 4 file(s), 13.7 KB of source, external domains: downloads.synapse-mcp.dev

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/synapse-mcp.js install --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawnSync } = require('child_process');

4const { install, resolvePaths } = require('../lib/install');

High

Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L2

5const { offerMcpConfig } = require('../lib/mcp-config');

6const { printVersionInfo } = require('../lib/version');

8const { binPath: BIN_PATH } = resolvePaths();

9const PACKAGE_NAME = '@myelixlabs/synapse-mcp';

11async function run(args) {

12 await install({ quiet: true, packageName: PACKAGE_NAME });

13 const result = spawnSync(BIN_PATH, args, { stdio: 'inherit' });

14 process.exit(result.status ?? 1);

15}

17function usage() {

18 console.error('Usage: npx @myelixlabs/synapse-mcp <command> [args]');

19 console.error('Commands:');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/synapse-mcp.jsView on unpkg · L2

20 console.error(' install Download or update the Synapse MCP launcher');

21 console.error(' setup Detect editors and offer to configure MCP servers');

22 console.error(' auth Start device sign-in');

lib/install.jsView file

Lines 1-23javascript

1const fs = require('fs');

2const path = require('path');

3const crypto = require

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code