registry / aifp-mcp / 1.3.0

aifp-mcp@1.3.0

AiFP 记忆感知系统 — 没有记录，只做记忆感知 MCP Server

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The package performs install-time mutation of multiple AI-agent control surfaces. The postinstall script adds MCP servers, hooks, and global instructions for Claude, Cursor, Windsurf, Cline, and Codex without requiring an explicit setup command.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install or npm install -g runs package postinstall

Impact

Future AI tool sessions may automatically load this package's MCP server or injected instructions/hooks, expanding agent behavior without explicit user approval.

Mechanism

unconsented AI-agent config and instruction injection

Policy narrative

On installation, npm runs scripts/postinstall.mjs. That script edits user-level AI assistant files and MCP configs, including Claude settings/hooks, global rule files, Cursor/Cline/Windsurf MCP configs, and Codex MCP configuration. This is not limited to an explicit setup command and affects broad foreign AI-agent control surfaces.

Rationale

Static source inspection confirms unconsented install-time mutation of broad AI-agent control surfaces, which meets the firewall block policy even without confirmed credential exfiltration. The explicit setup command is package-aligned, but the postinstall path performs the same class of mutations automatically.

Evidence

package.jsonscripts/postinstall.mjsdist/setup.jshooks/recall-hook.mjsdist/remote-client.jsdist/config.js~/.claude/settings.json~/.claude/hooks/check-aifp-status.mjs~/.claude/CLAUDE.md~/.cursorrules~/.windsurfrules~/.clinerules~/.codex/CODEX.md~/.cursor/mcp.json~/.config/cline/mcp_settings.json~/.codeium/windsurf/mcp_config.json~/.codex/config.toml

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for policy block

package.json runs postinstall: node scripts/postinstall.mjs
scripts/postinstall.mjs writes ~/.claude/settings.json mcpServers and SessionStart hook during install
scripts/postinstall.mjs injects startup rules into ~/.claude/CLAUDE.md, ~/.cursorrules, ~/.windsurfrules, ~/.clinerules, ~/.codex/CODEX.md
scripts/postinstall.mjs writes MCP configs for Cursor, Cline, Windsurf, and Codex CLI or runs codex mcp add
dist/setup.js also configures Claude/Codex hooks and MCP, but as explicit aifp-setup command

Evidence against

No hardcoded exfiltration endpoint in postinstall path
Remote client requires user-set COGNITION_SERVER_URL and COGNITION_API_KEY
Core package behavior is an MCP memory server using local ~/.ai-cognition data
No obfuscated payload or credential harvesting found in inspected files

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 26 file(s), 211 KB of source, external domains: hf-mirror.com, huggingface.co, your-server.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-38json

2 "name": "aifp-mcp",

3 "version": "1.3.0",

4 "description": "AiFP 记忆感知系统 — 没有记录，只做记忆感知 MCP Server",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "aifp-mcp": "dist/index.js",

9 "aifp-setup": "dist/setup.js"

10 },

11 "scripts": {

12 "start": "tsx src/index.ts",

13 "server": "tsx src/server.ts",

14 "setup": "tsx src/setup.ts",

15 "setup:dist": "node dist/setup.js",

16 "build": "tsc",

17 "prepublishOnly": "tsc",

18 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "publishConfig": {

21 "access": "public"

22 },

23 "files": [

24 "dist/",

25 "scripts/",

26 "hooks/",

27 "README.md",

28 "package.json"

29 ],

30 "dependencies": {

31 "@modelcontextprotocol/sdk": "^1.29.0",

32 "@xenova/transformers": "^2.17.2"

33 },

34 "optionalDependencies": {

35 "@zvec/zvec": "^0.5.0"

36 },

37 "devDependencies": {

38 "@types/node": "^26.0.1",

dist/setup.jsView file

Lines 1-24javascript

1import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';

2import { homedir } from 'os';

3import { resolve, dirname } from 'path';

4import { fileURLToPath } from 'url';

5import { execSync } from 'child_process';

scripts/backfill-links.mjsView file

Lines 1-37javascript

1/**

2 * 回填脚本：把所有孤立记忆全部关联上

3 * 1. 去重合并相同内容的记忆

4 * 2. 所有孤立节点通过语义相似度/标签自动建立 CO_OCCURS_WITH 链接

5 *

6 * 运行：node scripts/backfill-links.mjs

7 */

8import { fileURLToPath } from 'url'

9import { dirname, resolve } from 'path'

11const

dist/import.jsView file

Lines 117-157javascript

117 if (formats.includes(ext)) {

118 out.push({ path: full, format: ext, mtimeMs: st.mtimeMs });

119 }

120 }

121 catch { }

122 }

123}

124export async function importSources() {

125

dist/db.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = aifp-mcp@1.2.0 matchedIdentity = npm:YWlmcC1tY3A:1.2.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/db.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/setup.jsView file

4import { fileURLToPath } from 'url'; L5: import { execSync } from 'child_process'; L6: const __filename = fileURLToPath(import.meta.url);

High

Child Process

Package source references child process execution.

dist/setup.jsView on unpkg · L4

123}); L124: const codexCommand = isSourceMode ? `npx tsx "${SRC_ENTRY}"` : `node "${DIST_ENTRY}"`; L125: if (detect('codex')) { L126: try { L127: execSync(`codex mcp add ai-cognition -- ${codexCommand}`, { stdio: 'ignore', timeout: 5000 }); L128: results.push({ name: 'Codex CLI', configured: true, message: '已通过 codex mcp add 配置' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup.jsView on unpkg · L123

scripts/backfill-links.mjsView file

17try { L18: db = await import(resolve(projectRoot, 'dist/db.js')) L19: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/backfill-links.mjsView on unpkg · L17

dist/import.jsView file

137else { L138: items = parseJsonItems(JSON.parse(text)); L139: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/import.jsView on unpkg · L137

dist/db.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/db.jsView on unpkg

Findings

1 Critical4 High5 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/db.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/setup.js

HighShell

HighRuntime Package Installdist/setup.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/backfill-links.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/import.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

package.jsonView file

Lines 1-38json

2 "name": "aifp-mcp",

3 "version": "1.3.0",

4 "description": "AiFP 记忆感知系统 — 没有记录，只做记忆感知 MCP Server",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "aifp-mcp": "dist/index.js",

9 "aifp-setup": "dist/setup.js"

10 },

11 "scripts": {

12 "start": "tsx src/index.ts",

13 "server": "tsx src/server.ts",

14 "setup": "tsx src/setup.ts",

15 "setup:dist": "node dist/setup.js",

16 "build": "tsc",

17 "prepublishOnly": "tsc",

18 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "publishConfig": {

21 "access": "public"

22 },

23 "files": [

24 "dist/",

25 "scripts/",

26 "hooks/",

27 "README.md",

28 "package.json"

29 ],

30 "dependencies": {

31 "@modelcontextprotocol/sdk": "^1.29.0",

32 "@xenova/transformers": "^2.17.2"

33 },

34 "optionalDependencies": {

35 "@zvec/zvec": "^0.5.0"

36 },

37 "devDependencies": {

38 "@types/node": "^26.0.1",

dist/setup.jsView file

Lines 1-24javascript

1import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';

2import { homedir } from 'os';

3import { resolve, dirname } from 'path';

4import { fileURLToPath } from 'url';

5import { execSync } from 'child_process';

scripts/backfill-links.mjsView file

Lines 1-37javascript

1/**

2 * 回填脚本：把所有孤立记忆全部关联上

3 * 1. 去重合并相同内容的记忆

4 * 2. 所有孤立节点通过语义相似度/标签自动建立 CO_OCCURS_WITH 链接

5 *

6 * 运行：node scripts/backfill-links.mjs

7 */

8import { fileURLToPath } from 'url'

9import { dirname, resolve } from 'path'

11const

dist/import.jsView file

Lines 117-157javascript

117 if (formats.includes(ext)) {

118 out.push({ path: full, format: ext, mtimeMs: st.mtimeMs });

119 }

120 }

121 catch { }

122 }

123}

124export async function importSources() {

125

dist/db.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/db.jsView on unpkg

Lines 103-143javascript

103 message: _hookExists ? '已在 settings.json 中配置 UserPromptSubmit 自动注入' : 'hooks/recall-hook.mjs 未找到（跳过）',

104});

105const cursorDir = resolve(OUTPUT_DIR, '.cursor');

106const cursorMcpPath = resolve(cursorDir, 'mcp.json');

107if (!existsSync(cursorDir))

108 mkdirSync(cursorDir, { recursive: true });

109const cursorOk = writeJson(cursorMcpPath, { mcpServers: { 'ai-cognition': MCP_CONFIG } });

110results.push({

111 name: 'Cursor',

112 configured: cursorOk,

113 message: cursorOk ? `已写入 ${cursorMcpPath}` : '写入失败',

114});

115const windsurfConfigPath = resolve(HOME, '.codeium', 'windsurf', 'mcp_config.json');

116const windsurfOk = writeJson(windsurfConfigPath, {

117 mcpServers: { 'ai-cognition': MCP_CONFIG },

118});

119results.push({

120 name: 'Windsurf',

121 configured: windsurfOk,

122 message: windsurfOk ? `已写入 ${windsurfConfigPath}` : '写入失败',

123});

124const codexCommand = isSourceMode ? `npx tsx "${SRC_ENTRY}"` : `node "${DIST_ENTRY}"`;

125if (detect('codex')) {

126 try {

127 execSync(`codex mcp add ai-cognition -- ${codexCommand}`, { stdio: 'ignore', timeout: 5000 });

128 results.push({ name: 'Codex CLI', configured: true, message: '已通过 codex mcp add 配置' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup.jsView on unpkg · L123

129 }

130 catch {

131 const codexConfigDir = resolve(HOME, '.codex');

132 const codexConfigPath = resolve(codexConfigDir, 'config.toml');

133 if (!existsSync(codexConfigDir))

134 mkdirSync(codexConfigDir, { recursive: true });

135 try {

136 const cmd = isSourceMode ? 'npx' : 'node';

137 const arg = isSourceMode ? SRC_ENTRY : DIST_ENTRY;

138 const toml = `[mcp_servers.ai-cognition]\ncommand = "${cmd}"\nargs = ["${arg.replace(/\\/g, '\\\\')}"]\n`;

139 writeFileSync(codexConfigPath, toml);

140 results.push({ name: 'Codex CLI', configured: true, message: `已追加到 ${codexConfigPath}` });

141 }

142 catch {

143 results.push({ name: 'Codex CLI', configured: false, message: '手动配置: 见 AGENTS.md 说明' });