registry / @threenative/core / 0.3.3

@threenative/core@0.3.3

The small vanilla Three.js game runtime foundation.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Postinstall mutates several project AI-agent MCP configs by default, with only an environment opt-out, and registers this package's own local MCP servers. That is first-party agent extension setup on an install hook, gated to declaring projects, without a hidden foreign payload or credential export.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall after a consumer project that declares @threenative/core is installed, unless THREENATIVE_SKIP_MCP_SETUP is 1 or true.

Impact

Agent hosts that read those project files can start the package's asset, sculpt, engine, and Blender tools without a separate setup command. Existing conflicting server entries are not replaced, and machine-wide configs are not written.

Mechanism

ensure-mcp.mjs calls install.mjs, which creates or updates .mcp.json, .codex/config.toml, .cursor/mcp.json, .vscode/mcp.json, .gemini/settings.json, opencode.json, and .zed/settings.json with node commands for the package MCP shims.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsscripts/ensure-mcp.mjsmcp/install.mjsmcp/servers.mjsmcp/launch.mjs.mcp.json.codex/config.toml.cursor/mcp.json.vscode/mcp.json.gemini/settings.jsonopencode.json.zed/settings.json

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

npm postinstall runs scripts/postinstall.mjs, which applies a Three.js patch and then calls MCP setup.
MCP setup runs by default and stops only when THREENATIVE_SKIP_MCP_SETUP is 1 or true.
It writes project-scoped agent configs for Claude Code, Codex, Cursor, VS Code, Gemini CLI, opencode, and Zed.
Missing server entries are added with writeFileSync; existing same-named entries that differ are left in place.
Registered servers are local node shims under node_modules/@threenative/core/mcp.
Writes occur only for a consumer project whose package.json declares @threenative/core, not for nested installs or this package itself.
If a shim is later started and its dependency is missing, launch.mjs runs npx --yes on a pinned package name and version.

Evidence against

Install skips node_modules paths and projects that do not declare this package.
Configs are project files, not machine-wide agent settings, and unreadable JSON is left unchanged.
No install-time network call, credential read, or foreign command was found.
The npx fallback runs only when an MCP server is started and the local package is absent.

Source & flagged code

9 flagged

package.jsonView file

Lines 93-118json

93 "threenative-engine-mcp": "0.2.3",

94 "threenative-blender-mcp": "0.1.3"

95 },

96 "peerDependencies": {

97 "@threenative/playtest": ">=0.3.3 <0.4.0",

98 "react": ">=19.2.0 <20",

99 "react-reconciler": ">=0.33.0 <0.34"

100 },

101 "peerDependenciesMeta": {

102 "@threenative/playtest": {

103 "optional": true

104 },

105 "react": {

106 "optional": true

107 },

108 "react-reconciler": {

109 "optional": true

110 }

111 },

112 "scripts": {

113 "postinstall": "node ./scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L113

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L113

114 "build": "node scripts/generate-version.mjs && tsup --config tsup.config.ts && node scripts/bundle-engine-mcp.mjs && node scripts/bundle-blender-mcp.mjs && publint",

115 "typecheck": "tsc --noEmit",

116 "test": "publint --strict"

117 }

118}

mcp/launch.mjsView file

Lines 1-27javascript

1import { spawn } from "node:child_process";

2import { existsSync, readFileSync } from "node:fs";

3import path from "node:path";

4import { fileURLToPath, pathToFileURL } from "node:url";

mcp/install.mjsView file

Lines 1-21javascript

1import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

2import path from "node:path";

3import { CODEX_MCP_SERVERS, mergeMcpServers } from "./servers.mjs";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

mcp/install.mjsView on unpkg · L1

gpl/convert.pyView file

•path = gpl/convert.py kind = build_helper sizeBytes = 6997 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gpl/convert.pyView on unpkg

mcp/blender-server.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

mcp/blender-server.mjs#virtual:normalized:round1View on unpkg

mcp/blender-server.mjsView file

•matchType = normalized_sha256 matchedPackage = @threenative/core@0.3.2 matchedPath = mcp/blender-server.mjs matchedIdentity = npm:QHRocmVlbmF0aXZlL2NvcmU:0.3.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/blender-server.mjsView on unpkg

scripts/apply-three-patch.mjsView file

•matchType = normalized_sha256 matchedPackage = @threenative/core@0.3.2 matchedPath = scripts/apply-three-patch.mjs matchedIdentity = npm:QHRocmVlbmF0aXZlL2NvcmU:0.3.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/apply-three-patch.mjsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

mcp/launch.mjsView file

•matchType = normalized_sha256 matchedPackage = @threenative/core@0.3.2 matchedPath = mcp/launch.mjs matchedIdentity = npm:QHRocmVlbmF0aXZlL2NvcmU:0.3.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/launch.mjsView on unpkg

Findings

1 Critical5 High6 Medium6 Low

CriticalAi Agent Control Hijackmcp/install.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedmcp/blender-server.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritymcp/blender-server.mjs

HighKnown Malware Source Similaritymcp/launch.mjs

HighKnown Malware Source Similarityscripts/apply-three-patch.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiremcp/launch.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpergpl/convert.py

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @threenative/core@0.3.3.

See all versions of @threenative/core for other recorded verdicts.

Review the evidence and your use of @threenative/core@0.3.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 06:21:56.952Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

@threenative/core@0.3.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code