@spuentesp/lain-mcp@0.7.4
High-performance knowledge graph MCP server for AI coding agents with semantic search.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe source shows a postinstall executable download and execution, with archive integrity tied to a checksum fetched from the same release channel. This is a real supply-chain exposure but does not establish malicious behavior, so a warning is appropriate.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package with lifecycle scripts enabled, or invoking the `lain` command when the binary is absent.
Impact
A compromised or redirected release channel could supply executable code that runs during installation or command use. Source inspection does not establish that this occurred.
Mechanism
Downloads a release checksum and archive, compares the archive hash, extracts the binary, and runs it for a version check; the launcher later executes it.
AI rationale
The source shows a postinstall executable download and execution, with archive integrity tied to a checksum fetched from the same release channel. This is a real supply-chain exposure but does not establish malicious behavior, so a warning is appropriate.
Evidence
package.jsonscripts/install.jsscripts/runtime.jsbin/lain.js
Network endpoints1
github.com/spuentesp/lain/releases/download/
Decision evidence
public snapshotAI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall script that calls the installer.
- The installer downloads a native release archive and checksum file during postinstall unless skipped by its environment gates.
- The installer checks the archive against the downloaded checksum, extracts it, and runs the binary for a version check.
- The launcher executes the downloaded binary when the user invokes the command.
Evidence against
- The download URLs point to the package's named GitHub repository, and the archive is checked against a SHA-256 checksum fetched from that release.
- The installed binary is stored in a versioned cache, and the launcher forwards the user's arguments to it.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg2scripts.postinstall = node scripts/install.js
Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution.
L4: const fs = require('fs');
L5: const https = require('https');
L6: const os = require('os');
L7: const path = require('path');
L8: const { execFileSync, spawnSync } = require('child_process');
L9:
...
L11:
L12: function targetFor(platform = process.platform, arch = process.arch) {
L13: const targets = { 'darwin-arm64': 'aarch64-apple-darwin', 'linux-x64': 'x86_64-unknown-linux-gnu', 'win32-x64': 'x86_64-pc-windows-msvc' };
L14: const target = targets[`${platform}-${arch}`];
L15: if (!target) throw new Error(`Unsupported platform: ${platform}-${arch}`);
L16: return target;
L2:
L3: const {
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L2•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
Findings
3 High6 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighUnverified Remote Native Payload Installpackage.json
HighSemantic Analysis Limitedpackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencescripts/install.js
MediumAi Review Evidencescripts/runtime.js
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @spuentesp/lain-mcp@0.7.4.
See all versions of @spuentesp/lain-mcp for other recorded verdicts.
- Review the evidence and your use of @spuentesp/lain-mcp@0.7.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.