registry  /  @myelixlabs/synapse-mcp  /  0.1.0-poc

@myelixlabs/synapse-mcp@0.1.0-poc

POC installer/launcher for the Synapse MCP precompiled binary.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystem
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 1 file(s), 6.47 KB of source, external domains: downloads.synapse-mcp.dev

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node bin/synapse-mcp.js install --quiet
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node bin/synapse-mcp.js install --quiet
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/synapse-mcp.jsView file
4const path = require('path'); L5: const { execSync } = require('child_process'); L6: ... L8: // Use environment variables to override defaults. L9: const BASE_URL = process.env.SYNAPSE_MCP_BASE_URL || 'https://downloads.synapse-mcp.dev/synapse-mcp'; L10: const BIN_NAME = process.platform === 'win32' ? 'synapse-mcp.exe' : 'synapse-mcp'; L11: // Default install location: ~/.synapse-mcp ... L56: try { L57: // stdio: 'inherit' pipes the stdout/stderr of the child process to the parent. L58: execSync(command, { stdio: 'inherit' });
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/synapse-mcp.jsView on unpkg · L4

Findings

2 High3 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitybin/synapse-mcp.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License