registry / AI-agent control-surface risk / @sibrik/editor
@sibrik/editor
Local MCP server for Sibrik.ai video editing — runs Remotion Studio and renders MP4 on your machine
This report shows the evidence for @sibrik/editor@1.0.13. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has a concrete, unconsented postinstall mutation of a foreign AI-agent control surface. Its video-editing runtime behavior appears feature-aligned, but does not mitigate that install-time persistence.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall
Impact
Unconsented AI-agent control-surface persistence and subsequent package execution.
Mechanism
cross-platform Claude Desktop MCP configuration mutation
Policy narrative
On installation, dist/postinstall.js locates or creates Claude Desktop's configuration and inserts an MCP entry that executes `npx -y @sibrik/editor`. This persists independently of an explicit Claude configuration action and causes the package to be launched by Claude Desktop later.
AI rationale
The package has a concrete, unconsented postinstall mutation of a foreign AI-agent control surface. Its video-editing runtime behavior appears feature-aligned, but does not mitigate that install-time persistence.
Evidence
package.jsondist/postinstall.jsdist/index.jsREADME.md~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/Claude/claude_desktop_config.json
Network endpoints1
mcp.sibrik.io/mcp
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs dist/postinstall.js on postinstall.
- dist/postinstall.js creates/edits Claude Desktop MCP config.
- It registers sibrik-editor as npx -y @sibrik/editor without consent.
- Registration affects macOS, Windows, and Linux Claude config paths.
Evidence against
- No credential harvesting or exfiltration found.
- dist/index.js network downloads are tool-invoked media fetches.
- Runtime child processes implement declared Remotion rendering/studio features.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node dist/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
13import os from "node:os";
L14: import { exec } from "node:child_process";
L15:
High
454
Findings
1 Critical5 High4 Medium4 Low
CriticalAi Agent Control Hijackdist/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @sibrik/editor@1.0.13.
The versions list below shows the verdict for each recorded version.
- Avoid installing @sibrik/editor@1.0.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.