Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@sibrik/editor@1.0.13: AI-agent control-surface risk | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Soft block: AI-agent control surface

Warn by default; block when configured. Unconsented AI-agent control-surface persistence and subsequent package execution.

View on npm All versions Policy details

registry / @sibrik/editor / 1.0.13

@sibrik/editor@1.0.13

Local MCP server for Sibrik.ai video editing — runs Remotion Studio and renders MP4 on your machine

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently adds a persistent MCP server to Claude Desktop's configuration. The registered server runs this package through npx when Claude starts.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Unconsented AI-agent control-surface persistence and subsequent package execution.

Mechanism

cross-platform Claude Desktop MCP configuration mutation

Policy narrative

On installation, dist/postinstall.js locates or creates Claude Desktop's configuration and inserts an MCP entry that executes `npx -y @sibrik/editor`. This persists independently of an explicit Claude configuration action and causes the package to be launched by Claude Desktop later.

Rationale

The package has a concrete, unconsented postinstall mutation of a foreign AI-agent control surface. Its video-editing runtime behavior appears feature-aligned, but does not mitigate that install-time persistence.

Evidence

package.jsondist/postinstall.jsdist/index.jsREADME.md~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/Claude/claude_desktop_config.json

Network endpoints1

mcp.sibrik.io/mcp

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs dist/postinstall.js on postinstall.
dist/postinstall.js creates/edits Claude Desktop MCP config.
It registers sibrik-editor as npx -y @sibrik/editor without consent.
Registration affects macOS, Windows, and Linux Claude config paths.

Evidence against

No credential harvesting or exfiltration found.
dist/index.js network downloads are tool-invoked media fetches.
Runtime child processes implement declared Remotion rendering/studio features.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 2 file(s), 42.0 KB of source

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

13import os from "node:os"; L14: import { exec } from "node:child_process"; L15:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

454function startStudio(project2, port = 3e3) { L455: const child = spawn( L456: "npx", ... L460: stdio: ["ignore", "pipe", "pipe"], L461: env: { ...process.env }, L462: shell: process.platform === "win32", ... L465: ); L466: const url = `http://localhost:${port}`; L467: child.stdout?.on("data", (data) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L454

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

dist/postinstall.jsView file

27console.log(JSON.stringify({ L28: mcpServers: { L29: [SERVER_KEY]: { ... L36: } L37: let config = { mcpServers: {} }; L38: try { ... L40: config = JSON.parse(raw); L41: if (!config.mcpServers || typeof config.mcpServers !== "object") { L42: config.mcpServers = {}; L43: } ... L51: console.log(JSON.stringify({ L52: mcpServers: {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/postinstall.jsView on unpkg · L27

Findings

1 Critical5 High4 Medium4 Low

CriticalAi Agent Control Hijackdist/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighSemantic Analysis Limiteddist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

98%Soft block

Verdict confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

Package metadata

npm

Version1.0.13

PublishedAug 6, 2026

LicenseUNLICENSED

Dependencies7

Integrityverified

Package size30.4 KB

Files6

Keywordsmcpsibrikremotionvideoeditorclaude

Runtime surface

package.json

Entrypointsmain → dist/index.jsbin → sibrik-editor

Runtimenode >=18

Artifact130 KB · 6 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkShellHighEntropyStringsNoLicense

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@sibrik/editor",

3 "version": "1.0.13",

4 "description": "Local MCP server for Sibrik.ai video editing — runs Remotion Studio and renders MP4 on your machine",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "sibrik-editor": "dist/index.js"

9 },

10 "scripts": {

11 "build": "esbuild src/index.ts --bundle --platform=node --format=esm --packages=external --outfile=dist/index.js --sourcemap && npm run build:postinstall",

12 "start": "node dist/index.js",

13 "dev": "tsx watch src/index.ts",

14 "typecheck": "tsc --noEmit",

15 "build:postinstall": "esbuild src/postinstall.ts --bundle --platform=node --format=esm --packages=external --outfile=dist/postinstall.js --sourcemap",

16 "postinstall": "node dist/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "engines": {

19 "node": ">=18"

20 },

21 "dependencies": {

22 "@modelcontextprotocol/sdk": "^1.12.0",

23 "@remotion/bundler": "^4.0.0",

24 "@remotion/cli": "^4.0.0",

25 "@remotion/renderer": "^4.0.0",

26 "dotenv": "^16.4.5",

27 "remotion": "^4.0.0",

28 "zod": "^3.24.0"

29 },

30 "devDependencies": {

31 "@types/node": "^22.10.0",

32 "esbuild": "^0.25.0",

33 "tsx": "^4.19.0",

34 "typescript": "^5.7.0"

35 },

36 "files": [

dist/index.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3// src/index.ts

4import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

5

6// src/server.ts

7import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

8import { z } from

dist/postinstall.jsView file

Lines 7-47javascript

7 const platform = process.platform;

8 const home = os.homedir();

9 if (platform === "darwin") {

10 return

"zod"

;

9

10// src/remotion/project.ts

11import { promises as fs } from "node:fs";

12import path from "node:path";

13import os from "node:os";

14import { exec } from "node:child_process";

15

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

16// src/remotion/templates.ts

17var positionToStyle = {

18 top: "flex-start",

19 center: "center",

20 bottom: "flex-end"

21};

22function generateEntryFile(state) {

23 return `import { Composition, registerRoot } from 'remotion';

24import { SibrikComposition } from './SibrikComposition';

25

26const RemotionRoot: React.FC = () => {

27 return (

28 <Composition

29 id="SibrikComposition"

30 component={SibrikComposition}

31 durationInFrames={${state.durationFrames}}

32 fps={${state.fps}}

33 width={${state.width}}

Lines 434-474javascript

434 child.on("close", (code) => {

435 if (code !== 0) {

436 reject(new Error(`Render process exited with code ${code}`));

437 return;

438 }

439 try {

440 const result = JSON.parse(stdout.trim());

441 resolve({

442 outputPath: result.outputPath,

443 durationSeconds: result.durationSeconds

444 });

445 } catch {

446 resolve({ outputPath: out, durationSeconds: 0 });

447 }

448 });

449 child.on("error", (err) => {

450 reject(new Error(`Failed to start render process: ${err.message}`));

451 });

452 });

453}

454function startStudio(project2, port = 3e3) {

455 const child = spawn(

456 "npx",

457 ["remotion", "studio", "src/index.tsx", "--port", String(port), "--no-open"],

458 {

459 cwd: project2.dir,

460 stdio: ["ignore", "pipe", "pipe"],

461 env: { ...process.env },

462 shell: process.platform === "win32",

463 detached: true

464 }

465 );

466 const url = `http://localhost:${port}`;

467 child.stdout?.on("data", (data) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L454

468 process.stderr.write(`[studio] ${data}`);

469 });

470 child.stderr?.on("data", (data) => {

471 process.stderr.write(`[studio] ${data}`);

472 });

473 return { process: child, url };

474}

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

path.

join

(home,

"Library"

,

"Application Support"

,

"Claude"

,

"claude_desktop_config.json"

);

11 }

12 if (platform === "win32") {

13 const appData = process.env.APPDATA || path.join(home, "AppData", "Roaming");

14 return path.join(appData, "Claude", "claude_desktop_config.json");

15 }

16 if (platform === "linux") {

17 const configHome = process.env.XDG_CONFIG_HOME || path.join(home, ".config");

18 return path.join(configHome, "Claude", "claude_desktop_config.json");

19 }

20 return null;

21}

22async function main() {

23 const configPath = getConfigPath();

24 if (!configPath) {

25 console.log("[sibrik-editor] Unsupported platform \u2014 skip auto-config.");

26 console.log("[sibrik-editor] Please add the MCP server manually to your Claude Desktop config:");

27 console.log(JSON.stringify({

28 mcpServers: {

29 [SERVER_KEY]: {

30 command: "npx",

31 args: ["-y", "@sibrik/editor"]

32 }

33 }

34 }, null, 2));

35 return;

36 }

37 let config = { mcpServers: {} };

38 try {

39 const raw = await fs.readFile(configPath, "utf-8");

40 config = JSON.parse(raw);

41 if (!config.mcpServers || typeof config.mcpServers !== "object") {

42 config.mcpServers = {};

43 }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/postinstall.jsView on unpkg · L27

44 } catch {

45 const configDir = path.dirname(configPath);

46 try {

47 await fs.mkdir(configDir, { recursive: true });