registry / AI-agent control-surface risk / aifp-mcp
aifp-mcp
AiFP Cognitive Memory — persistent memory MCP server for AI assistants. Chinese-first retrieval with causal chains, Hebbian associations and graph diffusion. 记忆感知系统
This report shows the evidence for aifp-mcp@1.5.4. 6 of 7 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete unconsented postinstall mutation of broad third-party AI-agent control surfaces combined with credential reuse and prompt exfiltration. It meets the package firewall block boundary.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install (postinstall), then AI-agent startup/session activity.
Impact
Unconsented persistence in AI tools, credential reuse, and exfiltration of user prompts.
Mechanism
install-time AI-agent configuration and hook injection with prompt capture and LLM submission
Policy narrative
Installing the package invokes setup without user confirmation. It configures detected AI tools and adds Claude hooks; for pi it writes an extension that reads the local DeepSeek credential, captures the latest user message at agent end, and queues it. The enabled recognizer builds prompts from queued messages and calls the configured LLM, which the generated extension defaults to DeepSeek using the harvested credential.
AI rationale
This is a concrete unconsented postinstall mutation of broad third-party AI-agent control surfaces combined with credential reuse and prompt exfiltration. It meets the package firewall block boundary.
Evidence
scripts/postinstall.mjsdist/setup/platforms.jsdist/setup/pi-template.jsdist/recognizer.js~/.claude/settings.json~/.claude/hooks/check-aifp-status.mjs~/.claude/hooks/recall-aifp-memory.mjs~/.cursor/mcp.json~/.codex/config.toml~/.pi/agent/auth.json~/.pi/agent/extensions/aifp-memory/index.ts~/.pi/agent/extensions/aifp-memory/package.json
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- postinstall imports and runs configureAll automatically.
- Setup writes MCP entries into detected third-party AI-tool configs.
- postinstall installs Claude hooks for session start and every submitted prompt.
- Generated pi extension reads its stored DeepSeek key and enables recognizer.
- Pi agent_end captures user messages; recognizer submits them to the configured LLM.
Evidence against
- No package-owned fixed remote server URL is embedded for its optional remote mode.
- The remote client requires a configured server URL and API key.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/setup/platforms.jsView file
3import { homedir } from 'os';
L4: import { execSync } from 'child_process';
L5: const HOME = homedir();
High
Child Process
Package source references child process execution.
dist/setup/platforms.jsView on unpkg · L3•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
const args = s.args.map((a) => a.replace(/\\/g, '\\\\')).join('", "');
toml += `\n[mcp_servers.ai-cognition]\ncommand = "${s.command}"\nargs = ["${args}"]\n`;
writefilesync(p, toml, 'utf-8');
return 'ok';
}
catch {
return 'error';
}
},
},
{
id: 'dsh', name: 'deepseek harness (dsh)',
detected: () => existssync(join(home, '.dsh')),
configure: (s) => {
const p = join(home, '.dsh', 'cordis.patch.yml');
try {
mkdirsync(dirname(p), { recursive: true });
let yaml = '';
try {
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/setup/platforms.jsView on unpkgscripts/postinstall.mjsView file
10L11: import { existsSync, mkdirSync, writeFileSync, copyFileSync } from 'fs'
L12: import { resolve, dirname, join } from 'path'
...
L43: try {
L44: const hooksDir = join(homedir(), '.claude', 'hooks')
L45: mkdirSync(hooksDir, { recursive: true })
L46: const settingsPath = join(homedir(), '.claude', 'settings.json')
L47: let settings = {}
...
L55: const dstFile = join(hooksDir, h.dst)
L56: copyFileSync(srcFile, dstFile)
L57: const targetCmd = `node "${dstFile}"`.replace(/\\/g, '/')
...
L70: if (changed) {
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L10dist/setup/pi-extension.jsView file
24if (!existsSync(join(PI_EXT_DIR, 'node_modules'))) {
L25: execSync('npm install --no-audit --no-fund', { cwd: PI_EXT_DIR, stdio: 'ignore', timeout: 300000 });
L26: }
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/setup/pi-extension.jsView on unpkg · L24Findings
1 Critical5 High4 Medium6 Low
CriticalAi Agent Control Hijackscripts/postinstall.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/setup/platforms.js
HighShell
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/setup/platforms.js
HighRuntime Package Installdist/setup/pi-extension.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to aifp-mcp@1.5.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing aifp-mcp@1.5.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
7 known versions1.5.4latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 14, 2026, 11:40 AM1.5.3MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 14, 2026, 7:57 AM1.5.2MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 14, 2026, 5:26 AM1.3.6Suspicious—WarnPublishedJul 10, 2026, 3:56 PM1.3.3MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 10, 2026, 3:23 PM1.3.0MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 5, 2026, 5:25 PM1.2.0MaliciousSoft block: AI-agent control surfaceBlockPublishedJun 30, 2026, 4:59 PM