Loading npm security reports…

@telora/mcp-products@0.22.123: AI-agent control-surface risk | LPM Firewall

registry / @telora/mcp-products / 0.22.123

@telora/mcp-products@0.22.123

MCP server exposing Telora product operations to Claude Code

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package can modify the user's Claude Code configuration. It registers executable hooks for all tool-use and prompt-submission events when matching binaries are on PATH.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation, when both Telora hook binaries are available.

Impact

Commands outside this package become configured to run on future AI-agent events without an explicit setup command.

Mechanism

Automatic persistent Claude Code hook registration.

Policy narrative

The package manifest automatically launches scripts/postinstall.js during installation. If two executables are found on PATH, that script creates or edits ~/.claude/settings.json and registers them as command hooks for PostToolUse and UserPromptSubmit. This changes a broad AI-agent control surface without an explicit user setup action and persists after installation.

AI rationale

This is an unconsented postinstall mutation of a foreign, broad AI-agent control surface. The conditional executable lookup does not remove the automatic persistent configuration change when the condition is met.

Evidence

package.jsonscripts/postinstall.js~/.claude/settings.json

Decision evidence

public snapshot

AI identified this as a at 98.0% confidence with false-positive risk.

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

5// Runs after `npm install -g @telora/mcp-products`. If telora-ai-hook and L6: // telora-ai-human-hook are available, configures them in ~/.claude/settings.json. L7: // Never fails the install -- all errors are swallowed silently. ... L12: const { execSync } = require("child_process"); L13: const { readFileSync, writeFileSync, mkdirSync, existsSync } = require("fs"); L14: const { join } = require("path"); ... L34: L35: // Read or create ~/.claude/settings.json L36: const claudeDir = join(homedir(), ".claude"); L37: const settingsPath = join(claudeDir, "settings.json"); ... L89: if (!existsSync(claudeDir)) { L90: mkdirSync(claudeDir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L5

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node "use strict"; const { execsync } = require("child_process"); const { readfilesync, writefilesync, mkdirsync, existssync } = requi

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.133 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.133 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

dist/handlers/daemonConfig.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/handlers/daemonConfig.js#virtual:normalized:round1View on unpkg

dist/handlers/daemonConfig.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.149 matchedPath = dist/handlers/daemonConfig.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.149 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/daemonConfig.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.130 matchedPath = dist/index.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@telora/mcp-products",

3 "version": "0.22.123",

4 "description": "MCP server exposing Telora product operations to Claude Code",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "telora-mcp-products": "dist/index.js"

9 },

10 "files": [

11 "dist",

12 "scripts",

13 "README.md"

14 ],

15 "scripts": {

16 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "build": "tsc",

18 "start": "node dist/index.js",

19 "dev": "npx tsx src/index.ts",

20 "lint": "eslint .",

21 "typecheck": "tsc --noEmit",

22 "test": "tsx --test src/__tests__/*.test.ts",

23 "clean": "rm -rf dist",

24 "prepublishOnly": "npm run build"

25 },

26 "publishConfig": {

27 "access": "public",

28 "registry": "https://git.syntelyos.com:3100/api/packages/syntelyos/npm/"

29 },

30 "engines": {

31 "node": ">=18.0.0"

32 },

33 "license": "MIT",

34 "repository": {

35 "type": "git",

36 "url": "ssh://git@10.1.1.250:3122/syntelyos/telora.git",

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// ---------------------------------------------------------------------------

3// postinstall: wire up Claude Code hooks if telora-ai binaries are on PATH

4// ---------------------------------------------------------------------------

5// Runs after `npm install -g @telora/mcp-products`. If telora-ai-hook and

6// telora-ai-human-hook are available, configures them in ~/.claude/settings.json.

7// Never fails the install -- all errors are swallowed silently.

8// ---------------------------------------------------------------------------

9

10"use strict"

dist/handlers/daemonConfig.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/handlers/daemonConfig.js#virtual:normalized:round1View on unpkg

dist/handlers/daemonConfig.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.149 matchedPath = dist/handlers/daemonConfig.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.149 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/daemonConfig.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/mcp-products@0.22.130 matchedPath = dist/index.js matchedIdentity = npm:QHRlbG9yYS9tY3AtcHJvZHVjdHM:0.22.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg