Loading npm security reports…

@telora/mcp-products: AI-agent control-surface risk | LPM Firewall

registry / @telora/mcp-products / 0.22.175

@telora/mcp-products@0.22.175

MCP server exposing Telora product operations to Claude Code

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently modifies global Claude Code settings to execute Telora commands on agent events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation when telora-ai-hook and telora-ai-human-hook are available on PATH.

Impact

Future Claude Code sessions execute the configured commands across projects, extending control beyond this package.

Mechanism

The postinstall script adds or updates command hooks for PostToolUse and UserPromptSubmit and persists them without a consent check.

Policy narrative

The npm postinstall hook resolves two Telora binaries and, when both exist, reads the user's global Claude settings. It creates or updates command hooks for tool use and prompt submission and saves the configuration without requesting consent. The binary-presence condition limits activation but does not authorize mutation of the broader agent control surface.

AI rationale

Inspected source proves unconsented install-time mutation of a foreign, global AI-agent control surface. This meets the blocking policy even though the commands are Telora-related and no credential theft was established.

Evidence

package.jsonscripts/postinstall.js.claude/settings.json

Decision evidence

public snapshot

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

5// Runs after `npm install -g @telora/mcp-products`. If telora-ai-hook and L6: // telora-ai-human-hook are available, configures them in ~/.claude/settings.json. L7: // Never fails the install -- all errors are swallowed silently. ... L15: import { execSync } from "node:child_process"; L16: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; L17: import { join } from "node:path"; ... L37: L38: // Read or create ~/.claude/settings.json L39: const claudeDir = join(homedir(), ".claude"); L40: const settingsPath = join(claudeDir, "settings.json"); ... L92: if (!existsSync(claudeDir)) { L93: mkdirSync(claudeDir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L5

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.174 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.174 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @telora/mcp-products@0.22.111 matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.111 similarity = 0.564 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

dist/handlers/daemonConfig.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/handlers/daemonConfig.js#virtual:normalized:round1View on unpkg

dist/handlers/daemonConfig.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.174 matchedPath = dist/handlers/daemonConfig.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.174 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/daemonConfig.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = b8199390a297a5f1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @telora/mcp-products@0.22.174 matchedPath = dist/handlers/daemonConfig.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.174 similarity = 1.000 shingleOverlap = 14 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/handlers/daemonConfig.jsView on unpkg

dist/tool-registration.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.174 matchedPath = dist/tool-registration.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.174 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tool-registration.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@telora/mcp-products",

3 "version": "0.22.175",

4 "description": "MCP server exposing Telora product operations to Claude Code",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "telora-mcp-products": "dist/index.js"

9 },

10 "files": [

11 "dist",

12 "scripts",

13 "README.md"

14 ],

15 "scripts": {

16 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "build": "tsc",

18 "start": "node dist/index.js",

19 "dev": "npx tsx src/index.ts",

20 "lint": "eslint .",

21 "typecheck": "tsc --noEmit",

22 "test": "tsx --test src/__tests__/*.test.ts",

23 "clean": "rm -rf dist",

24 "prepublishOnly": "npm run build"

25 },

26 "publishConfig": {

27 "access": "public",

28 "registry": "https://git.syntelyos.com:3100/api/packages/syntelyos/npm/"

29 },

30 "engines": {

31 "node": ">=18.0.0"

32 },

33 "license": "MIT",

34 "repository": {

35 "type": "git",

36 "url": "ssh://git@10.1.1.250:3122/syntelyos/telora.git",

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// ---------------------------------------------------------------------------

3// postinstall: wire up Claude Code hooks if telora-ai binaries are on PATH

4// ---------------------------------------------------------------------------

5// Runs after `npm install -g @telora/mcp-products`. If telora-ai-hook and

6// telora-ai-human-hook are available, configures them in ~/.claude/settings.json.

7// Never fails the install -- all errors are swallowed silently.

8// ---------------------------------------------------------------------------

9

10// This package is "type": "module", so this .js is loaded as ESM. It MUST use

dist/handlers/daemonConfig.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/handlers/daemonConfig.js#virtual:normalized:round1View on unpkg

dist/handlers/daemonConfig.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.174 matchedPath = dist/handlers/daemonConfig.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.174 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/daemonConfig.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = b8199390a297a5f1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @telora/mcp-products@0.22.174 matchedPath = dist/handlers/daemonConfig.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.174 similarity = 1.000 shingleOverlap = 14 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/handlers/daemonConfig.jsView on unpkg

dist/tool-registration.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.174 matchedPath = dist/tool-registration.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.174 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tool-registration.jsView on unpkg