Loading npm security reports…

@telora/mcp-products@0.22.114: AI-agent control-surface risk | LPM Firewall

registry / @telora/mcp-products / 0.22.114

@telora/mcp-products@0.22.114

MCP server exposing Telora product operations to Claude Code

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall creates or rewrites Claude Code's global hook configuration when Telora hook binaries exist. It registers those commands for broad prompt and tool-use events without an explicit user setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of the package while telora-ai-hook and telora-ai-human-hook are on PATH

Impact

External binaries gain automatic execution on Claude Code UserPromptSubmit and PostToolUse events.

Mechanism

install-time mutation of ~/.claude/settings.json to add command hooks

Policy narrative

The package's npm postinstall runs automatically, discovers two external Telora binaries, then creates or rewrites ~/.claude/settings.json. It inserts them as command hooks for all Claude Code UserPromptSubmit and PostToolUse events. This is an unconsented install-time mutation of a broad foreign AI-agent control surface; errors are suppressed so the install does not disclose failure or mutation.

Rationale

Direct source inspection confirms an install-triggered write to Claude Code's global settings that registers broad command hooks. This meets the policy's concrete AI-agent control-hijack block condition.

Evidence

package.jsonscripts/postinstall.js~/.claude/settings.json

Decision evidence

public snapshot

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

5// Runs after `npm install -g @telora/mcp-products`. If telora-ai-hook and L6: // telora-ai-human-hook are available, configures them in ~/.claude/settings.json. L7: // Never fails the install -- all errors are swallowed silently. ... L12: const { execSync } = require("child_process"); L13: const { readFileSync, writeFileSync, mkdirSync, existsSync } = require("fs"); L14: const { join } = require("path"); ... L34: L35: // Read or create ~/.claude/settings.json L36: const claudeDir = join(homedir(), ".claude"); L37: const settingsPath = join(claudeDir, "settings.json"); ... L89: if (!existsSync(claudeDir)) { L90: mkdirSync(claudeDir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L5

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node "use strict"; const { execsync } = require("child_process"); const { readfilesync, writefilesync, mkdirsync, existssync } = requi

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.113 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.113 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 282b12be9fbbba50 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @telora/mcp-products@0.22.113 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.113 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/postinstall.jsView on unpkg

dist/handlers/daemonConfig.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.113 matchedPath = dist/handlers/daemonConfig.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.113 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/daemonConfig.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.113 matchedPath = dist/index.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.113 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@telora/mcp-products",

3 "version": "0.22.114",

4 "description": "MCP server exposing Telora product operations to Claude Code",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "telora-mcp-products": "dist/index.js"

9 },

10 "files": [

11 "dist",

12 "scripts",

13 "README.md"

14 ],

15 "scripts": {

16 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "build": "tsc",

18 "start": "node dist/index.js",

19 "dev": "npx tsx src/index.ts",

20 "lint": "eslint .",

21 "typecheck": "tsc --noEmit",

22 "test": "tsx --test src/__tests__/*.test.ts",

23 "clean": "rm -rf dist",

24 "prepublishOnly": "npm run build"

25 },

26 "publishConfig": {

27 "access": "public",

28 "registry": "https://git.syntelyos.com:3100/api/packages/syntelyos/npm/"

29 },

30 "engines": {

31 "node": ">=18.0.0"

32 },

33 "license": "MIT",

34 "repository": {

35 "type": "git",

36 "url": "ssh://git@10.1.1.250:3122/syntelyos/telora.git",

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// ---------------------------------------------------------------------------

3// postinstall: wire up Claude Code hooks if telora-ai binaries are on PATH

4// ---------------------------------------------------------------------------

5// Runs after `npm install -g @telora/mcp-products`. If telora-ai-hook and

6// telora-ai-human-hook are available, configures them in ~/.claude/settings.json.

7// Never fails the install -- all errors are swallowed silently.

8// ---------------------------------------------------------------------------

9

10"use strict"

dist/handlers/daemonConfig.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.113 matchedPath = dist/handlers/daemonConfig.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.113 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/daemonConfig.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.113 matchedPath = dist/index.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.113 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg