Loading npm security reports…

@szc-ft/mcp-szcd-client@0.38.0: AI-agent control-surface risk | LPM Firewall

registry / @szc-ft/mcp-szcd-client / 0.38.0

@szc-ft/mcp-szcd-client@0.38.0

MCP client for szcd component library - auto-configures AI coding tools with MCP server, skills, agents and commands

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm 安装会未经交互修改多个第三方 AI 编程工具的用户级控制面，并注册包指定的 MCP 服务。随后代理可将本地配置中的认证材料转发至该远程服务。

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install @szc-ft/mcp-szcd-client

Impact

持久化扩展 Codex、Claude、Qwen、OpenCode 等的用户级 AI 代理能力，并使其连接包指定的远程 MCP 服务。

Mechanism

postinstall 注入跨平台代理/MCP 配置、技能和代理指令

Policy narrative

安装生命周期默认运行完整设置：写入或调用多个 AI 工具的用户级 MCP 配置，复制技能/命令，并以默认的远程 szcd MCP URL 注册服务；即使 Codex CLI 不存在也直接写入其配置。运行代理时，代码会把本地配置中的 CODING cookies、密码和 API key 放入请求头发往该端点，且 HTTPS 请求关闭证书校验。这构成未获同意的广泛 AI 代理控制面变更。

Rationale

源码确认了安装时对多个非本包拥有的 AI 工具用户配置的持久化修改，满足阻断条件。运行时还存在向默认远程 MCP 服务转发本地认证配置的具体链路。

Evidence

package.jsonscripts/postinstall.jsscripts/lib/common.jsscripts/lib/codex.jsscripts/lib/claude-code.jsmcp-proxy.jsscripts/lib/qwen-code.jsscripts/lib/opencode.js~/.codex/config.toml~/.claude.json~/.qwen/extensions/szcd-component-helper~/.config/opencode/opencode.jsonc~/.agents/skills

Network endpoints2

mcp.szcd-mcp.top/mcp

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

qwen-extension/skills/local-browser-test/tests/integration/pr-03.test.jsView file

285it('build 后 qwen-extension 含 3 个新 lib 文件', async () => { L286: const { spawnSync } = await import('node:child_process'); L287: // build 并发跑 ENOTEMPTY race condition（PR #0 rmSync），加 retry

High

Child Process

Package source references child process execution.

qwen-extension/skills/local-browser-test/tests/integration/pr-03.test.jsView on unpkg · L285

qwen-extension/skills/local-browser-test/lib/cdp-browser-config.jsView file

31} catch { L32: // 方案2：PowerShell Get-CimInstance L33: try {

High

Shell

Package source references shell execution.

qwen-extension/skills/local-browser-test/lib/cdp-browser-config.jsView on unpkg · L31

qwen-extension/skills/local-browser-test/lib/browser-engine.jsView file

3232try { L3233: this._cdpScripts[step.name] = new Function('page', 'frame', 'params', 'browser', 'return (' + step.code + ')(page, frame, params, browser)'); L3234: return { type: 'registerCdpScript', name: step.name, registered: true, status: 'PASS', passed: true };

Low

Eval

Package source references a known benign dynamic code generation pattern.

qwen-extension/skills/local-browser-test/lib/browser-engine.jsView on unpkg · L3232

qwen-extension/skills/local-browser-test/tests/integration/pr-04.test.jsView file

23L24: const { resolveCodeFile, detectNodeOnlyApi, buildErrorResult } = await import( L25: '../../lib/raw-script-helpers.js'

Medium

Dynamic Require

Package source references dynamic require/import behavior.

qwen-extension/skills/local-browser-test/tests/integration/pr-04.test.jsView on unpkg · L23

scripts/postinstall.jsView file

22Install-time AI-agent control hijack evidence: L107: L108: common.writeFile(configPath, JSON.stringify(configContent, null, 2)); L109: } ... L131: } L132: if (claudeResult.claudeProjectInstalled) { L133: console.log(` Claude Project: ${path.join(projectRoot, ".claude", "skills", common.getMcpServerName(), "SKILL.md")}`); L134: } ... L142: /* L143: if (openCodeResult.openCodeProjectInstalled) { L144: console.log(` OpenCode Project: ${path.join(projectRoot, ".opencode", "skills", common.getMcpServerName(), "SKILL.md")}`); L145: } Payload evidence from agents/build.js: L22: const __filename = fileURLToPath(import.meta.url); L23: const __dirname = path.dirname(__filename); L24: ... L259: const templateContent = fs.readFileSync(templatePath, "utf8"); L260: const tools = JSON.parse(fs.read

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L22

qwen-extension/skills/local-browser-test/tests/integration/pr-06.test.jsView file

22Cross-file remote execution chain: qwen-extension/skills/local-browser-test/tests/integration/pr-06.test.js spawns qwen-extension/skills/local-browser-test/lib/browser-engine.js; helper contains network access plus dynamic code execution. L22: const __filename = fileURLToPath(import.meta.url); L23: const __dirname = path.dirname(__filename); L24: const SKILL_DIR = path.resolve(__dirname, '../../'); ... L232: it('build 后 qwen-extension 含 retry-policy.js', async () => { L233: const { spawnSync } = await import('node:child_process'); L234: let result; ... L240: if (result.status === 0) break; L241: if (result.stderr?.toString().includes('ENOTEMPTY')) { L242: await new Promise((r) => setTimeout(r, 500));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

qwen-extension/skills/local-browser-test/tests/integration/pr-06.test.jsView on unpkg · L22

qwen-extension/skills/local-browser-test/lib/shared-deps.jsView file

87try { L88: execSync(`npm install ${installFlags} ${pkgList}`.trim(), { L89: cwd: SHARED_DEPS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

qwen-extension/skills/local-browser-test/lib/shared-deps.jsView on unpkg · L87

qwen-extension/skills/local-api-tool/scripts/extract_swagger.pyView file

•path = qwen-extension/skills/local-api-tool/scripts/extract_swagger.py kind = build_helper sizeBytes = 23931 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

qwen-extension/skills/local-api-tool/scripts/extract_swagger.pyView on unpkg

qwen-extension/commands/szcd-mcp-api-config.mdView file

28patternName = generic_password severity = medium line = 28 matchedText = npx szcd...ss>"

Medium

Secret Pattern

Hardcoded password in qwen-extension/commands/szcd-mcp-api-config.md

qwen-extension/commands/szcd-mcp-api-config.mdView on unpkg · L28

qwen-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView file

187patternName = generic_password severity = medium line = 187 matchedText = user: { ...' },

Medium

Secret Pattern

Hardcoded password in qwen-extension/skills/local-browser-test/tests/integration/pr-01.test.js

qwen-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView on unpkg · L187

commands/szcd-mcp-api-config.mdView file

28patternName = generic_password severity = medium line = 28 matchedText = npx szcd...ss>"

Medium

Secret Pattern

Hardcoded password in commands/szcd-mcp-api-config.md

commands/szcd-mcp-api-config.mdView on unpkg · L28

opencode-extension/commands/szcd-mcp-api-config.mdView file

28patternName = generic_password severity = medium line = 28 matchedText = npx szcd...ss>"

Medium

Secret Pattern

Hardcoded password in opencode-extension/commands/szcd-mcp-api-config.md

opencode-extension/commands/szcd-mcp-api-config.mdView on unpkg · L28

opencode-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView file

187patternName = generic_password severity = medium line = 187 matchedText = user: { ...' },

Medium

Secret Pattern

Hardcoded password in opencode-extension/skills/local-browser-test/tests/integration/pr-01.test.js

opencode-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView on unpkg · L187

standard-skill/local-browser-test/tests/integration/pr-01.test.jsView file

187patternName = generic_password severity = medium line = 187 matchedText = user: { ...' },

Medium

Secret Pattern

Hardcoded password in standard-skill/local-browser-test/tests/integration/pr-01.test.js

standard-skill/local-browser-test/tests/integration/pr-01.test.jsView on unpkg · L187