registry / @papi-ai/server / 0.7.74
@papi-ai/server@0.7.74
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not malicious under the stated boundary because no lifecycle hook or covert foreign-agent mutation exists. It warrants a warning for first-party AI-agent extension setup, persistent telemetry, and broad project automation capabilities.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the setup/init flow or invokes MCP setup/build features; normal server startup performs an npm update check.
Impact
User-authorized setup can modify project AI-agent configuration and enable a package-owned hook; telemetry identifies an installation and reports tool metadata.
Mechanism
explicit agent-extension setup, project scaffolding, telemetry, and git automation
AI rationale
This is not malicious under the stated boundary because no lifecycle hook or covert foreign-agent mutation exists. It warrants a warning for first-party AI-agent extension setup, persistent telemetry, and broad project automation capabilities.
Evidence
package.jsondist/index.jsdist/backfill-cycle-metrics.js.mcp.json.claude/settings.json.claude/hooks/frontend-design-guard.sh.claude/commandsCLAUDE.mdAGENTS.md.agents/skills/papi-cycle~/.papi/install-id.json
Network endpoints3
getpapi.aiguewgygcpcmrcoppihzx.supabase.coregistry.npmjs.org/@papi-ai/server/latest
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js: explicit setup writes MCP configuration and agent scaffolding.
- dist/index.js: setup can add Claude permission and a PreToolUse hook.
- dist/index.js: runtime creates a persistent ~/.papi install ID and emits telemetry.
- dist/index.js: command-capable MCP features invoke git and can post to a user-supplied Slack webhook.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- MCP configuration writes occur only through explicit setup/init tooling.
- Reset removes only the package's own MCP entry and normally prompts first.
- No source evidence of credential harvesting, remote payload execution, or stealth foreign-agent mutation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/backfill-cycle-metrics.jsView file
81});
L82: import { execFileSync, spawnSync } from "child_process";
L83: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L814307try {
L4308: const email = execSync("git config user.email", { encoding: "utf8", timeout: 5e3 }).trim();
L4309: if (email) return email;
...
L4318: }
L4319: var HOSTED_SUPABASE_URL2 = process.env["PAPI_HOSTED_SUPABASE_URL"] ?? "https://guewgygcpcmrcoppihzx.supabase.co";
L4320: var HOSTED_PROXY_ENDPOINT = `${HOSTED_SUPABASE_URL2}/functions/v1/data-proxy`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L4307dist/index.jsView file
82});
L83: import { execFileSync, spawnSync } from "child_process";
L84: function isGitAvailable() {
...
L120: if (add.status !== 0) {
L121: return { committed: false, message: (add.stderr || "git add failed").trim() };
L122: }
...
L397: );
L398: const raw = JSON.parse(out);
L399: return raw.map((p) => ({
...
L451: if (sshMatch) {
L452: return `https://${sshMatch[1]}/${sshMatch[2]}`;
L453: }
Findings
2 Critical4 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
Affected versions and remediation
This report applies to @papi-ai/server@0.7.74.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.74 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.