registry  /  @myelixlabs/synapse-mcp  /  0.1.2-poc

@myelixlabs/synapse-mcp@0.1.2-poc

POC installer/launcher for the Synapse MCP precompiled binary.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystem
Supply chain
UrlStrings
Manifest
NoLicense
scanned 1 file(s), 2.84 KB of source, external domains: downloads.synapse-mcp.dev

Source & flagged code

5 flagged · loading source
package.jsonView file
•scripts.postinstall = node bin/synapse-mcp.js install --quiet
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node bin/synapse-mcp.js install --quiet
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/synapse-mcp.jsView file
4const path = require('path'); L5: const { spawnSync } = require('child_process'); L6: const pkg = require('../package.json');
High
Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L4
4const path = require('path'); L5: const { spawnSync } = require('child_process'); L6: const pkg = require('../package.json'); L7: L8: const BASE_URL = process.env.SYNAPSE_MCP_BASE_URL || 'https://downloads.synapse-mcp.dev/synapse-mcp'; L9: const BIN_NAME = process.platform === 'win32' ? 'synapse-mcp.exe' : 'synapse-mcp'; L10: const INSTALL_DIR = process.env.SYNAPSE_MCP_INSTALL_DIR || path.join(process.env.HOME || process.env.USERPROFILE, '.synapse-mcp');
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/synapse-mcp.jsView on unpkg · L4
46install(true, false); L47: const result = spawnSync(BIN_PATH, args, { stdio: 'inherit' }); L48: process.exit(result.status ?? 1); ... L51: function usage() { L52: console.error('Usage: npx @myelixlabs/synapse-mcp <command> [args]'); L53: console.error('Commands:');
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/synapse-mcp.jsView on unpkg · L46

Findings

4 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/synapse-mcp.js
HighSandbox Evasion Gated Capabilitybin/synapse-mcp.js
HighRuntime Package Installbin/synapse-mcp.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License