@nookplot/mcp@0.4.141

Nookplot MCP server — connect any MCP-compatible agent to the Nookplot network

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Source inspection confirms an automatic install-time mutation of the global agent skills directory, so a warning is warranted. The behavior is package-owned skill setup rather than demonstrated broad control-surface abuse or credential theft.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with npm; server startup also installs or updates the skills.

Impact

Package-provided agent commands become available globally without a separate installation prompt; the full daemon skill requires user confirmation before starting its routines.

Mechanism

The hook copies bundled skill directories into ~/.claude/skills when ~/.claude exists.

AI rationale

Evidence

package.jsondist/postinstall.jsdist/index.jsskills/nookplot/SKILL.md~/.claude/skills/

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs dist/postinstall.js during npm installation.
The postinstall hook copies bundled skills into the existing global Claude Code skills directory without a consent prompt.
The server also installs those skills when it starts, including on version updates.
dist/setup.js detects the Cursor MCP configuration location; this cited location does not itself show a write.
The bundled skills are package-owned, and the full daemon skill asks the user to confirm before starting its routines.

Evidence against

The copied content is the package's own skills, and the full daemon skill requires user confirmation before starting its routines.
The reviewed install behavior copies skill files; it does not establish credential collection or exfiltration.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/applyConfig.jsView file

Lines 6-46javascript

6 *

7 * 1. User configured BYOK / model / messaging on the Nookplot web UI.

8 * 2. The browser encrypted it with AES-256-GCM and a random 256-bit key,

9 * POSTed the ciphertext to `/v1/agent-config/stage`, and got back a

10 * one-time token.

11 * 3. The install command exposed both as terminal env vars:

12 * NOOKPLOT_CONFIG_TOKEN=<token>

13 * NOOKPLOT_CONFIG_KEY=<base64url-encoded key>

14 * 4. The installer bash script calls this command with those values.

15 *

16 * We then:

17 * - Fetch the ciphertext via GET /v1/agent-config/redeem/:token. The

18 * gateway deletes the row as it returns the payload, so replays fail.

19 * - Decrypt locally using the key (which never left the terminal).

20 * - For each (key, value) pair in the JSON config, run

21 * `hermes config set KEY VALUE`. Hermes auto-routes secrets (API keys,

22 * bot tokens) to ~/.hermes/.env and other settings to ~/.hermes/config.yaml.

23 *

24 * @module applyConfig

25 */

26import { createDecipheriv } from "node:crypto";

27import { execFileSync } from "node:child_process";

28import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/applyConfig.jsView on unpkg · L26

29import { homedir } from "node:os";

30import { join } from "node:path";

31import { Wallet } from "ethers";

32/**

33 * Decode a base64url string (`-` `_`, no padding) to a Buffer.

34 * Web Crypto emits base64url by default, so our browser-side encryption

35 * produces keys in this form.

36 */

37function fromBase64Url(value) {

38 // Convert base64url → base64 by replacing URL-safe chars and

39 // re-padding to a multiple of 4.

40 let b64 = value.replace(/-/g, "+").replace(/_/g, "/");

41 const pad = b64.length % 4;

42 if (pad)

43 b64 += "=".repeat(4 - pad);

44 return Buffer.from(b64, "base64");

45}

46/**

dist/postinstall.jsView file

Lines 1-21javascript

1/**

2 * Postinstall script — copies skill files to ~/.claude/skills/ immediately

3 * when the package is installed via npm/npx. This ensures /nookplot, /mine,

4 * /social, and /learn are available on the very first Claude Code session,

5 * without waiting for the MCP server to start.

6 *

7 * Runs silently — any failure is swallowed (skills will be installed by

8 * the MCP server on startup as a fallback).

9 */

10import { existsSync, mkdirSync, readdirSync, statSync, copyFileSync }

dist/setup.jsView file

Lines 1-21javascript

1/**

2 * `npx @nookplot/mcp setup` — One-command onboarding.

3 *

4 * Detects installed editors, registers an agent, and writes MCP config

5 * so the user can restart their editor and immediately start using Nookplot.

6 *

7 * @module setup

8 */

9import *

dist/applyConfig.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/applyConfig.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/applyConfig.jsView file

26import { createDecipheriv } from "node:crypto"; L27: import { execFileSync } from "node:child_process"; L28: import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/applyConfig.jsView on unpkg · L26

Findings

1 Critical6 High4 Medium4 Low

CriticalAi Agent Control Hijackdist/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/applyConfig.js

HighShell

HighRuntime Package Installdist/setup.js

HighSemantic Analysis Limiteddist/applyConfig.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/setup.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @nookplot/mcp@0.4.141.

See all versions of @nookplot/mcp for other recorded verdicts.

Review the evidence and your use of @nookplot/mcp@0.4.141 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:02:36.943Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @nookplot

Runtime surface

Behavioral surface

Related packages

More from @nookplot

Source & flagged code