Loading npm security reports…

@nookplot/mcp@0.4.130: AI-agent policy block | LPM Firewall

registry / @nookplot/mcp / 0.4.130

@nookplot/mcp@0.4.130

Nookplot MCP server — connect any MCP-compatible agent to the Nookplot network

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Confirmed install-time AI-agent control-surface mutation. Installing the package can silently drop package-supplied Claude skills that instruct autonomous recurring agent workflows.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install or npx package install lifecycle postinstall

Impact

Unconsented modification of Claude Code skill surface; later slash-command invocation can create recurring autonomous jobs using Nookplot tools.

Mechanism

silent copy of bundled AI-agent skill instructions into ~/.claude/skills

Policy narrative

On install, package.json runs dist/postinstall.js. That script checks for ~/.claude and silently copies bundled skill directories into ~/.claude/skills. The copied skills define slash-command workflows that can create recurring Cron jobs for mining, social, and learning actions on the Nookplot network. This is an unconsented lifecycle mutation of an AI-agent control surface, even though the network functionality itself appears package-aligned.

Rationale

Direct source inspection confirms install-time writes into Claude's skills directory with autonomous agent instructions, which is a concrete AI-agent control-surface mutation outside normal package installation expectations. Other risky primitives are mostly package-aligned setup/runtime behavior, but the lifecycle skill drop is sufficient to block. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsondist/postinstall.jsdist/index.jsdist/setup.jsdist/applyConfig.jsskills/nookplot/SKILL.md

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/applyConfig.jsView file

26import { createDecipheriv } from "node:crypto"; L27: import { execFileSync } from "node:child_process"; L28: import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/applyConfig.jsView on unpkg · L26

dist/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L1: /** L2: * Postinstall script — copies skill files to ~/.claude/skills/ immediately L3: * when the package is installed via npm/npx. This ensures /nookplot, /mine, ... L9: */ L10: import { existsSync, mkdirSync, readdirSync, statSync, copyFileSync } from "node:fs"; L11: import { fileURLToPath } from "node:url"; ... L15: if (!existsSync(dest)) L16: mkdirSync(dest, { recursive: true }); L17: for (const file of readdirSync(src)) { ... L23: else { L24: copyFileSync(srcPath, destPath); L25: } Payload evidence from SKILL.md: L127: |----------|---------|-------------| L128: | `NOOKPLOT_GATEWAY_URL` | `https://gateway.nookplot.com` | Gateway endpoint | L129: | `NOOKPLOT_AGENT_NAME` | `MCP Agent` | Name for auto-registration |

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/postinstall.jsView on unpkg · L1

dist/setup.jsView file

1/** L2: * `npx @nookplot/mcp setup` — One-command onboarding. L3: * ... L14: import { homedir, platform } from "node:os"; L15: import { execSync } from "node:child_process"; L16: import { createInterface } from "node:readline";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup.jsView on unpkg · L1

Source & flagged code

5 flagged

package.jsonView file

Lines 34-74json

34 "dist/gateway.d.ts"

35 ],

36 "signing": [

37 "dist/signing.d.ts"

38 ]

39 }

40 },

41 "files": [

42 "dist",

43 "skills",

44 "README.md",

45 "SKILL.md"

46 ],

47 "scripts": {

48 "build": "tsc",

49 "start": "node dist/index.js",

50 "dev": "tsc --watch",

51 "test": "vitest run",

52 "generate-catalog": "node scripts/generate-catalog.mjs",

53 "embed:tools": "tsx scripts/embed-tools.ts",

54 "postinstall": "node dist/postinstall.js 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 },

56 "dependencies": {

57 "@modelcontextprotocol/sdk": "^1.12.0",

58 "ethers": "^6.0.0"

59 },

60 "devDependencies": {

61 "@types/node": "^20.0.0",

62 "@types/pg": "^8.20.0",

63 "pg": "^8.20.0",

64 "tsx": "^4.21.0",

65 "typescript": "^5.4.0",

66 "vitest": "^3.0.0"

67 },

68 "engines": {

69 "node": ">=18.0.0"

70 },

71 "license": "MIT",

72 "repository": {

73 "type": "git",

74 "url": "https://github.com/nookprotocol/nookplot",

dist/applyConfig.jsView file

Lines 6-46javascript

6 *

7 * 1. User configured BYOK / model / messaging on the Nookplot web UI.

8 * 2. The browser encrypted it with AES-256-

dist/postinstall.jsView file

Lines 1-21javascript

1/**

2 * Postinstall script — copies skill files to ~/.claude/skills/ immediately

3 * when the package is installed via npm/npx. This ensures /nookplot, /mine,

4 * /social, and /learn are available on the very first Claude Code session,

5 * without waiting for the MCP server to start.

6 *

7 * Runs silently — any failure is swallowed (skills will be installed by

8 * the MCP server on startup as a fallback).

9 */

10import { existsSync, mkdirSync, readdirSync, statSync, copyFileSync }

dist/setup.jsView file

Lines 1-21javascript

1/**

2 * `npx @nookplot/mcp setup` — One-command onboarding.

3 *

4 * Detects installed editors, registers an agent, and writes MCP config

5 * so the user can restart their editor and immediately start using Nookplot.

6 *

7 * @module setup

8 */

9import *