Loading npm security reports…

@respira/wordpress-mcp-server: Suspicious npm security report | LPM Firewall

registry / @respira/wordpress-mcp-server / 7.5.3

@respira/wordpress-mcp-server@7.5.3

200+ MCP tools for WordPress (275+ with the WooCommerce and ACF add-ons) across 16 page builders. Native page-builder access, context-aware tool filtering, and an agent persona loaded into every handshake. v7.1 'Roots': four new builders (Spectra, Kadence

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `--install-config` or `install-skills`; telemetry runs after MCP server startup and tool calls.

Impact

A remote service controls the MCP entry installed under the Respira server name; installed skills can influence future agent sessions, and telemetry discloses tool/site metadata.

Mechanism

Explicit AI-agent configuration/skill installation plus authenticated usage telemetry.

Rationale

No concrete malicious install-time or stealth execution chain was found. The package nevertheless has explicit-user-command AI-agent configuration mutation and persistent skill installation, so it merits a warning rather than a clean firewall verdict.

Evidence

package.jsondist/setup.jsdist/install-skills.jsdist/usage-emitter.jsskills/migrate-divi-to-bricks/SKILL.mdskills/wordpress-site-dna/telemetry.ts~/.codex/config.toml~/.claude.json~/.claude/skills<cwd>/.cursor/mcp.json~/.antigravity/mcp.json

Network endpoints3

Source & flagged code

2 flagged

dist/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @respira/wordpress-mcp-server@7.4.1 matchedIdentity = npm:[redacted]:7.4.1 similarity = 0.773 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.jsView on unpkg

dist/__tests__/system-ca.test.jsView file

Lines 46-86javascript

46const SERVER_CERT = `-----BEGIN CERTIFICATE-----

47MIIDUTCCAjmgAwIBAgIUD5Wl0BdVGQs3hpW0w3JyzU2FGoowDQYJKoZIhvcNAQEL

48BQAwHzEdMBsGA1UEAwwUUmVzcGlyYSBUZXN0IFJvb3QgQ0EwHhcNMjYwNjAxMTgw

49MTEwWhcNMzYwNTI5MTgwMTEwWjAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0G

50CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCiKHsJeEZQL0f71fYXO3elEYW8HQVX

51v9RL7x3Me2718lG5THlfp2uMrFBST8vJ6yO60WXUHn0sBjbFWg58qu0lsVGYa0xI

520uvSFbrPzdDUM9cPUJLvlq+ZpgOxZ4qEbzKI9G2KWr4eJpnhFz+bzNa0g/q8czAA

53l1qTkbYtDd8LSV2EtIGnEJYYFwhuAZ+dDvGJbi6ZWOeUtKjRbMebXZlrlaisy89W

54aaDRdudMsChZUcwH7ktCc4RTS7MQmvczZeZ2UIBT8gZrV438oSEZcRfz2dS5rUw4

55KfjgPdtMO+cEc3Fz0rtUTwHEzMV7nKCyLEtklLVKt0oQCHqZ02L4Pi5pAgMBAAGj

56gY8wgYwwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYB

57BQUHAwEwGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/AAABMB0GA1UdDgQWBBSWeyF6

587sfPmx0Zpur+AhJ5dsIekzAfBgNVHSMEGDAWgBS2NtzDOqe2ZaLuH0juojyGhDIN

596jANBgkqhkiG9w0BAQsFAAOCAQEAKtZUpy+t95OSYEpvb2yKGI4YqH0LO0+ydPVb

60Yc6DnA7c3Zj1pterKsnStaL3QjbwcyzRE88aTEPrtz8A5NkW0+qTuJWIfitR2zLO

61kflBJVVIV6YzqcelljEJJbQNXRD6TQclkFQI919Oqoho9bz6dZjgF/atKf/yaIoS

62vUD6C0r1xS7zYbEodMsfjoHP+2NmWEn1t+0Z1Gea50a/QVnD9VosNFKQtVdBT9EX

63lsGpsihaBeRjJt6qS4fjFPyNnJtihkfM8YDIvCe8RMqxuHosi81ZrXRPLUDlJYHD

640J2PrptdVNaLdvUG7XL17NdzyrN6Qd0uh+wVC+5AGsIr/f4ltw==

65-----END CERTIFICATE-----`;

66const SERVER_KEY = `-----BEGIN PRIVATE KEY-----

Critical

Secret Pattern

RSA private key in dist/__tests__/system-ca.test.js

dist/__tests__/system-ca.test.jsView on unpkg · L66

67MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCiKHsJeEZQL0f7

681fYXO3elEYW8HQVXv9RL7x3Me2718lG5THlfp2uMrFBST8vJ6yO60WXUHn0sBjbF

69Wg58qu0lsVGYa0xI0uvSFbrPzdDUM9cPUJLvlq+ZpgOxZ4qEbzKI9G2KWr4eJpnh

70Fz+bzNa0g/q8czAAl1qTkbYtDd8LSV2EtIGnEJYYFwhuAZ+dDvGJbi6ZWOeUtKjR

71bMebXZlrlaisy89WaaDRdudMsChZUcwH7ktCc4RTS7MQmvczZeZ2UIBT8gZrV438

72oSEZcRfz2dS5rUw4KfjgPdtMO+cEc3Fz0rtUTwHEzMV7nKCyLEtklLVKt0oQCHqZ

7302L4Pi5pAgMBAAECggEADA6of17DE6lAV/hj0Pxp/Asef4tE325zEaZY9+BhssXu

74z7FhAPzI4W/alRQ72eqzAGwbfzc5JXHc1rXIh/qJoZjasVOhG3UbdcaJ2nO6SF0G

75a6wZENmKewk+Ew3Y3doKzuYl0vjGVCWYoYUCBMqpWEjL9wE1m4WlhX17J0R1xjfy

7628+vIBo/T3s8rAx28oIlkaAeksQScj0OJB0f4WGL9Op47sgWnyR5oETQDA0jJyxs

77MdMcD+MUnQ70uVTk5VlD8VVYJUjuzYc5cZ6VNIcyi4TPP/nSvJ01VhwnAzSUXLP2

78T+ZOOEUXZV6rIGodFPEITCW25hYpKLBxJL/dUBU2EQKBgQDgjY7Z3PBSc7DArDrC

79dxs5wK4v5D+3b6vybX0rK6cFPOmEREIdUk8mp25ICh3Opj4/U5D5RDHkHtO5tV00

80tB8akd4qeYDMRcr8IRhU18XDjjOIKUdtSW11mZ86pjVT/Y9XBeKwPfDlcX/qbBqD

812XAVCeFXFG+nq+Hcqlmq3GCTDQKBgQC43gHUj19+cUE8Shio+6grXywZqd/qGZuU

82IQu3n2RYRNHDyMecujwp9Sk6t2YAKiQ8eLjXU1rDcr6XeEKiLP/OpS4e3oktnojJ

8364Df2JRQ1vKXVOzYw1iK4GojpoUZjXeRAbyojiEwNjFaqYbDHXG0vhhWL0okob36

84LP4nsdLhzQKBgQC9WqF7VbPR03zY/GMQWR+8M56vA+o25RQ5+dny7XyKDjNcNbMK

85xr23+rgkR2ObPtR+0hkOGVN46gXgM+/E4Z7Y6OhPKOZTWwcwVTgPU2SQ4vjReP2i

86Sqji4ghDjKSrjsWwvGXL+G+LC4qyQzaYuGKrWwmKRNFisq5jRcMXMX6+gQKBgHWQ