Loading npm security reports…

@myelixlabs/synapse-mcp@3.0.6: AI-agent control-surface risk | LPM Firewall

registry / @myelixlabs/synapse-mcp / 3.0.6

@myelixlabs/synapse-mcp@3.0.6

Cuts AI token costs, eliminates hallucinated refactors and answers in <2ms — AST code-knowledge graph for Cursor, Claude Code, Windsurf, Warp, Continue & Zed. Runs fully local.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently downloads and executes a launcher, then mutates existing third-party AI-agent instruction files. The appended policy redirects agent behavior to Synapse and suppresses normal inspection tools.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs `node bin/synapse-mcp.js install --quiet`

Impact

Existing Gemini, Claude, Cursor, Windsurf, and Cline environments can be forced to use the package's MCP service for discovery.

Mechanism

postinstall AI-agent control-surface hijack plus remote launcher execution

Policy narrative

On installation, the postinstall invokes the quiet installer without user confirmation. It downloads a launcher from the package CDN, executes it, and appends a policy to any detected third-party agent instruction files. That policy requires the Synapse MCP server as the exclusive initial discovery tool and explicitly prohibits common file-inspection tools. This is unconsented install-time mutation of broad foreign AI-agent control surfaces.

Rationale

Direct source inspection confirms unconsented postinstall mutation of multiple foreign AI-agent instruction files, with instructions designed to redirect and constrain agent behavior. This meets the blocking policy regardless of the package's otherwise user-invoked features.

Evidence

package.jsonbin/synapse-mcp.jslib/install.js~/.synapse-mcp/synapse-mcp~/.gemini/config/AGENTS.md~/.claude/CLAUDE.md~/.cursorrules~/.windsurfrules

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

45const os = require('node:os'); L46: const childProcess = require('node:child_process'); L47:

High

Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L45

45const os = require('node:os'); L46: const childProcess = require('node:child_process'); L47: ... L49: L50: const PROD_API_BASE = 'https://api.synapse-mcp.dev'; L51: const DEFAULT_API_BASE = L52: (process.env.SYNAPSE_API_URL || process.env.SYNAPSE_MCP_API_BASE || PROD_API_BASE) L53: .replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/synapse-mcp.jsView on unpkg · L45

lib/service-os.jsView file

8* Linux → systemd user unit (~/.config/systemd/user/synapse-mcp.service) L9: * Windows → Task Scheduler (schtasks) L10: * ... L37: function homeDir(options) { L38: return options.homeDir || process.env.HOME || process.env.USERPROFILE || os.homedir(); L39: } ... L62: L63: function buildPlist(launcherPath, port, stdoutLog, stderrLog) { L64: return `<?xml version="1.0" encoding="UTF-8"?> ... L114: fs.writeFileSync(plist, buildPlist(launcher, port, stdoutLog, stderrLog)); L115: execSync(`launchctl load -w ${plist}`); L116:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/service-os.jsView on unpkg · L8

lib/install.jsView file

8* - Install dir: ~/.synapse-mcp/ L9: * - CDN base: https://downloads.synapse-mcp.dev/synapse-mcp L10: * - Supported platforms: darwin-aarch64, darwin-x86_64, linux-x86_64, ... L23: const crypto = require('node:crypto'); L24: const childProcess = require('node:child_process'); L25: const os = require('node:os'); ... L56: function platformId() { L57: if (process.platform === 'linux' && process.arch === 'x64') return 'linux-x86_64'; L58: if (process.platform === 'linux' && process.arch === 'arm64') return 'linux-aarch64'; ... L71: const baseUrl = options.baseUrl || L72: process.env.SYNAPSE_MCP_BASE_URL || L73: DEFAULT_BASE_URL;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/install.jsView on unpkg · L8

lib/service.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.4 matchedPath = lib/service.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/service.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

Lines 25-65javascript

25 * repos add → repos.add()

26 * repos archive → repos.archive()

27 * repos restore → repos.restore()

28 * repos remove → repos.remove()

29 * repos reindex → repos.reindex()

30 * ui → startDashboard() + open browser

31 *

32 * Exported for testing:

33 * run(deps) — smart dispatch (no-args entry)

34 * runInstallWizard(deps) — full install wizard steps

35 *

36 * Why all external effects are injectable:

37 * The BDD first_run_wizard scenarios drive the entire orchestration without

38 * any real binary, real HTTP, or real OS calls by injecting stubs.

39 */

40

41'use strict';

42

43const fs = require('node:fs');

44const path = require('node:path');

45const os = require('node:os');

46const childProcess = require('node:child_process');

47

High

Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L45

48// ─── Defaults ─────────────────────────────────────────────────────────────────

49

50const PROD_API_BASE = 'https://api.synapse-mcp.dev';

51const DEFAULT_API_BASE =

52 (process.env.SYNAPSE_API_URL || process.env.SYNAPSE_MCP_API_BASE || PROD_API_BASE)

53 .replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/synapse-mcp.jsView on unpkg · L45

54const DEFAULT_WEB_BASE = 'https://synapse-mcp.dev';

55const DEFAULT_DOWNLOADS = 'https://downloads.synapse-mcp.dev/synapse-mcp';

56const DEFAULT_SYNAPSE_PORT = 8585;

57const DEFAULT_DASH_PORT = 8686;

58

59/**

60 * Typed error thrown by main() when it wants to exit with a non-zero code.

61 * The require.main block (and only that block) catches this and calls

62 * process.exit(err.exitCode). Tests catch it too and can assert on the code

63 * without the test runner being killed.

64 *

65 * Why: process.exit() inside main() terminates the entire Cucumber runner

lib/service-os.jsView file

Lines 1-28javascript

1'use strict';

2

3/**

4 * lib/service-os.js — OS-level autostart registration.

5 *

6 * Supports three platforms:

7 * macOS → launchd plist (~/Library/LaunchAgents/dev.synapse-mcp.plist)

8 * Linux → systemd user unit (~/.config/systemd/user/synapse-mcp.service)

9 * Windows → Task Scheduler (schtasks)

10 *

Medium

Install Persistence

lib/install.jsView file

Lines 1-28javascript

1'use strict';

2

3/**

4 * lib/install.js — binary download and integrity verification.

5 *

6 * Ported from sample_mcp/npm/lib/install.js and adapted for Synapse MCP:

7 * - Package name: synapse-mcp (not sample-mcp)

8 * - Install dir: ~/.synapse-mcp/

9 * - CDN base: https://downloads.synapse-mcp.dev/synapse-mcp

10 * - Supported platforms: darwin-aarch64, darwin-x86_64, linux-x86_64,

11

lib/service.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.4 matchedPath = lib/service.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/service.jsView on unpkg