Loading npm security reports…

@myelixlabs/synapse-mcp@3.3.0: AI-agent control-surface risk | LPM Firewall

registry / @myelixlabs/synapse-mcp / 3.3.0

@myelixlabs/synapse-mcp@3.3.0

Cuts AI token costs, eliminates hallucinated refactors and answers in <2ms — AST code-knowledge graph for Cursor, Claude Code, Windsurf, Warp, Continue & Zed. Runs fully local.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently downloads and executes a vendor launcher, then mutates existing AI-agent rule/control files. The injected policy constrains agents to use Synapse and prohibits normal discovery tools.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Unconsented control of multiple installed AI-agent workflows and execution of downloaded code.

Mechanism

silent remote binary bootstrap plus cross-agent rule injection

Policy narrative

Installing the package invokes `install --quiet`. That path downloads a launcher, marks it executable, runs it, and silently appends a “MCP-First Discovery Policy” to detected foreign agent files. The policy mandates Synapse as the exclusive discovery engine and tells agents not to use normal filesystem/search tools, creating an unconsented broad AI-agent control surface.

Rationale

This is concrete install-time mutation of foreign AI-agent control files, not merely interactive first-party setup. The hidden quiet path also bootstraps and executes remote code.

Evidence

package.jsonbin/synapse-mcp.jslib/install.jslib/mcp-config.js~/.synapse-mcp/synapse-mcp~/.gemini/config/AGENTS.md~/.claude/CLAUDE.md~/.cursorrules~/.windsurfrules~/.clinerules

Network endpoints1

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8scripts.postinstall = node bin/synapse-mcp.js install --quiet || true Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L8: * → launcher installed + service running → show status L9: * → launcher installed + service stopped → offer to start L10: * → not installed → run full wizard ... L14: * install --quiet → silent install (CI / postinstall) L15: * start → service.start() L16: * stop → service.stop() L17: * restart → service.restart() L18: * status → service.status() ... L29: * repos reindex → repos.reindex() L30: * ui → startDashboard() + open browser L31: * ... L37: * The

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L8

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

45const os = require('node:os'); L46: const childProcess = require('node:child_process'); L47:

High

Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L45

45const os = require('node:os'); L46: const childProcess = require('node:child_process'); L47: ... L49: L50: const PROD_API_BASE = 'https://api.synapse-mcp.dev'; L51: const DEFAULT_API_BASE = L52: (process.env.SYNAPSE_API_URL || process.env.SYNAPSE_MCP_API_BASE || PROD_API_BASE) L53: .replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/synapse-mcp.jsView on unpkg · L45

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.5.1 matchedPath = bin/synapse-mcp.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.5.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/synapse-mcp.jsView on unpkg

bin/synapse-mcp.js#virtual:normalized:round1View file

614probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

614Trigger-reachable command-output exfiltration chain: scripts.postinstall -> bin/synapse-mcp.js L614: probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

lib/service.jsView file

25const os = require('node:os'); L26: const childProcess = require('node:child_process'); L27: const http = require('node:http'); L28: ... L43: L44: function homeDir() { L45: return process.env.HOME || process.env.USERPROFILE || os.homedir(); L46: } ... L63: L64: function stdoutLog(installDir) { L65: return path.join(logDir(installDir), 'stdout.log'); ... L72: function launcherPath(installDir) {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/service.jsView on unpkg · L25

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.5.1 matchedPath = lib/service.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.5.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/service.jsView on unpkg

lib/install.jsView file

251Install-time code directly mutates a foreign AI-agent control surface: L251: const buf = Buffer.from(await res.arrayBuffer()); L252: fs.writeFileSync(tmp, buf); L253: if (process.platform !== 'win32') fs.chmodSync(tmp, 0o755); ... L305: L306: fs.mkdirSync(installDir, { recursive: true }); L307: ... L379: const ruleTargets = [ L380: { path: require('path').join(homedir, '.gemini', 'config', 'AGENTS.md'), dirOnly: true }, L381: { path: require('path').join(homedir, '.claude', 'CLAUDE.md'), dirOnly: true }, L382: { path: require('path').join(homedir, '.cursorrules'), parentDir: require('path').join(homedir, '.cursor') }, L383: { path: require('path').join(homedir, '.windsurfrules'), parentDir: require('path').join(homedir, '.codeium', 'windsurf') }, L384: { path: require('path').join(homedi

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.jsView on unpkg · L251

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.5.1 matchedPath = lib/install.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.5.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/install.jsView on unpkg

lib/server.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.4.0 matchedPath = lib/server.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/server.jsView on unpkg

lib/service-os.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.5.1 matchedPath = lib/service-os.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.5.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/service-os.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8scripts.postinstall = node bin/synapse-mcp.js install --quiet || true Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L8: * → launcher installed + service running → show status L9: * → launcher installed + service stopped → offer to start L10: * → not installed → run full wizard ... L14: * install --quiet → silent install (CI / postinstall) L15: * start → service.start() L16: * stop → service.stop() L17: * restart → service.restart() L18: * status → service.status() ... L29: * repos reindex → repos.reindex() L30: * ui → startDashboard() + open browser L31: * ... L37: * The

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L8

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

Lines 25-65javascript

25 * repos add → repos.add()

26 * repos archive → repos.archive()

27 * repos restore → repos.restore()

28 * repos remove → repos.remove()

29 *

bin/synapse-mcp.js#virtual:normalized:round1View file

614probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

614Trigger-reachable command-output exfiltration chain: scripts.postinstall -> bin/synapse-mcp.js L614: probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

lib/service.jsView file

Lines 5-45javascript

5 *

6 * Responsibilities:

7 * start() — spawn launcher with --http --port <port>, detach, write PID file,

8

lib/install.jsView file

Lines 231-271javascript

231

232/**

233 * Download a launcher binary via Node's built-in fetch.

234 *

235 * Why fetch (not curl): CI images like node:20-slim and many minimal

236 * environments do not ship curl. Node >=18 (our engines floor) provides

237 * fetch, so we avoid an external binary dependency for postinstall.

238 */

239async function downloadArtifact(url

lib/server.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.4.0 matchedPath = lib/server.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/server.jsView on unpkg

lib/service-os.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.5.1 matchedPath = lib/service-os.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.5.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/service-os.jsView on unpkg