Loading npm security reports…

@myelixlabs/synapse-mcp@3.0.7: AI-agent control-surface risk | LPM Firewall

registry / @myelixlabs/synapse-mcp / 3.0.7

@myelixlabs/synapse-mcp@3.0.7

Cuts AI token costs, eliminates hallucinated refactors and answers in <2ms — AST code-knowledge graph for Cursor, Claude Code, Windsurf, Warp, Continue & Zed. Runs fully local.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Unconsented postinstall downloads a native launcher and alters existing third-party AI-agent instruction/control files. The injected rules force use of the package's MCP server and restrict normal discovery tools.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation invokes postinstall: node bin/synapse-mcp.js install --quiet.

Impact

Hijacks behavior of installed AI coding agents without user approval and establishes a package-controlled discovery path.

Mechanism

silent binary download plus foreign AI-agent control-surface rule injection

Policy narrative

On npm install, the quiet postinstall downloads a platform launcher to ~/.synapse-mcp and invokes it for a version check. The installer then silently appends a mandatory “MCP-First Discovery Policy” to existing Gemini, Claude, Cursor, Windsurf, and Cline agent files. That policy requires the package’s Synapse MCP server as the exclusive discovery engine and forbids normal filesystem search tools, changing unrelated agents’ behavior without consent.

Rationale

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, not merely an explicit setup command. The forced rules redirect agent behavior to a downloaded package-controlled service.

Evidence

package.jsonbin/synapse-mcp.jslib/install.js~/.gemini/config/AGENTS.md~/.claude/CLAUDE.md~/.cursorrules~/.windsurfrules~/.clinerules

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

45const os = require('node:os'); L46: const childProcess = require('node:child_process'); L47:

High

Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L45

45const os = require('node:os'); L46: const childProcess = require('node:child_process'); L47: ... L49: L50: const PROD_API_BASE = 'https://api.synapse-mcp.dev'; L51: const DEFAULT_API_BASE = L52: (process.env.SYNAPSE_API_URL || process.env.SYNAPSE_MCP_API_BASE || PROD_API_BASE) L53: .replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/synapse-mcp.jsView on unpkg · L45

lib/service-os.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.6 matchedPath = lib/service-os.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/service-os.jsView on unpkg

8* Linux → systemd user unit (~/.config/systemd/user/synapse-mcp.service) L9: * Windows → Task Scheduler (schtasks) L10: * ... L37: function homeDir(options) { L38: return options.homeDir || process.env.HOME || process.env.USERPROFILE || os.homedir(); L39: } ... L62: L63: function buildPlist(launcherPath, port, stdoutLog, stderrLog) { L64: return `<?xml version="1.0" encoding="UTF-8"?> ... L114: fs.writeFileSync(plist, buildPlist(launcher, port, stdoutLog, stderrLog)); L115: execSync(`launchctl load -w ${plist}`); L116:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/service-os.jsView on unpkg · L8

lib/install.jsView file

8* - Install dir: ~/.synapse-mcp/ L9: * - CDN base: https://downloads.synapse-mcp.dev/synapse-mcp L10: * - Supported platforms: darwin-aarch64, darwin-x86_64, linux-x86_64, ... L23: const crypto = require('node:crypto'); L24: const childProcess = require('node:child_process'); L25: const os = require('node:os'); ... L56: function platformId() { L57: if (process.platform === 'linux' && process.arch === 'x64') return 'linux-x86_64'; L58: if (process.platform === 'linux' && process.arch === 'arm64') return 'linux-aarch64'; ... L71: const baseUrl = options.baseUrl || L72: process.env.SYNAPSE_MCP_BASE_URL || L73: DEFAULT_BASE_URL;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/install.jsView on unpkg · L8

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.6 matchedPath = lib/install.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/install.jsView on unpkg

lib/server.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.6 matchedPath = lib/server.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/server.jsView on unpkg

lib/service.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.6 matchedPath = lib/service.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/service.jsView on unpkg

lib/auto-update.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.6 matchedPath = lib/auto-update.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auto-update.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

Lines 25-65javascript

25 * repos add → repos.add()

26 * repos archive → repos.archive()

27 * repos restore → repos.restore()

28 * repos remove → repos.remove()

29 * repos reindex → repos.reindex()

30 * ui → startDashboard() + open browser

31 *

32 * Exported for testing:

33 * run(deps) — smart dispatch (no-args entry)

34 * runInstallWizard(deps) — full install wizard steps

35 *

36 * Why all external effects are injectable:

37 * The BDD first_run_wizard scenarios drive the entire orchestration without

38 * any real binary, real HTTP, or real OS calls by injecting stubs.

39 */

40

41'use strict';

42

43const fs = require('node:fs');

44const path = require('node:path');

45const os = require('node:os');

46const childProcess = require('node:child_process');

47

High

Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L45

48// ─── Defaults ─────────────────────────────────────────────────────────────────

49

50const PROD_API_BASE = 'https://api.synapse-mcp.dev';

51const DEFAULT_API_BASE =

52 (process.env.SYNAPSE_API_URL || process.env.SYNAPSE_MCP_API_BASE || PROD_API_BASE)

53 .replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/synapse-mcp.jsView on unpkg · L45

54const DEFAULT_WEB_BASE = 'https://synapse-mcp.dev';

55const DEFAULT_DOWNLOADS = 'https://downloads.synapse-mcp.dev/synapse-mcp';

56const DEFAULT_SYNAPSE_PORT = 8585;

57const DEFAULT_DASH_PORT = 8686;

58

59/**

60 * Typed error thrown by main() when it wants to exit with a non-zero code.

61 * The require.main block (and only that block) catches this and calls

62 * process.exit(err.exitCode). Tests catch it too and can assert on the code

63 * without the test runner being killed.

64 *

65 * Why: process.exit() inside main() terminates the entire Cucumber runner

lib/service-os.jsView file

Lines 1-28javascript

1'use strict';

2

3/**

4 * lib/service-os.js — OS-level autostart registration.

5 *

6 * Supports three platforms:

7 * macOS → launchd plist (~/Library/LaunchAgents/dev.synapse-mcp.plist)

8 * Linux → systemd user unit (~/.config/systemd/user/synapse-mcp.service)

9 * Windows → Task Scheduler (schtasks)

10 *

Medium

Install Persistence

lib/install.jsView file

Lines 1-28javascript

1'use strict';

2

3/**

4 * lib/install.js — binary download and integrity verification.

5 *

6 * Ported from sample_mcp/npm/lib/install.js and adapted for Synapse MCP:

7 * - Package name: synapse-mcp (not sample-mcp)

8 * - Install dir: ~/.synapse-mcp/

9 * - CDN base: https://downloads.synapse-mcp.dev/synapse-mcp

10 * - Supported platforms: darwin-aarch64, darwin-x86_64, linux-x86_64,

11

lib/server.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.6 matchedPath = lib/server.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/server.jsView on unpkg

lib/service.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.6 matchedPath = lib/service.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/service.jsView on unpkg

lib/auto-update.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.0.6 matchedPath = lib/auto-update.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auto-update.jsView on unpkg