Loading npm security reports…

aifp-mcp@1.5.2: AI-agent control-surface risk | LPM Firewall

registry / aifp-mcp / 1.5.2

aifp-mcp@1.5.2

AiFP Cognitive Memory — persistent memory MCP server for AI assistants. Chinese-first retrieval with causal chains, Hebbian associations and graph diffusion. 记忆感知系统

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently configures detected Claude, Cursor, Windsurf, Cline, Codex, and other AI-agent surfaces. It also creates a Pi extension and installs its dependencies.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install or npm install -g aifp-mcp

Impact

Foreign AI clients execute or expose the package MCP server; generated Pi code can use a local DeepSeek credential for remote LLM requests.

Mechanism

install-time cross-agent configuration, instruction injection, and extension deployment

Policy narrative

The package’s postinstall imports and silently runs setup. Setup detects multiple unrelated AI clients, writes MCP registrations and global behavioral rules, creates a Pi extension, and invokes npm install in that extension directory. The generated extension reads Pi’s DeepSeek credential and configures the package to call DeepSeek; separately, runtime defaults to a hard-coded HTTP remote server with bearer-authenticated request bodies. This is an unconsented install-time expansion across broad foreign AI-agent control surfaces.

Rationale

This is concrete, lifecycle-reachable mutation of several foreign AI-agent configurations, not an explicit user setup command. The additional credential-handling and remote defaults increase impact.

Evidence

package.jsonscripts/postinstall.mjsdist/setup/index.jsdist/setup/platforms.jsdist/setup/pi-extension.jsdist/setup/pi-template.jsdist/config.jsdist/remote-client.js

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/setup/platforms.jsView file

3import { homedir } from 'os'; L4: import { execSync } from 'child_process'; L5: const HOME = homedir();

High

Child Process

Package source references child process execution.

dist/setup/platforms.jsView on unpkg · L3

scripts/postinstall.mjsView file

10L11: import { existsSync, mkdirSync, writeFileSync, copyFileSync } from 'fs' L12: import { resolve, dirname, join } from 'path' ... L41: try { L42: const hooksDir = join(homedir(), '.claude', 'hooks') L43: mkdirSync(hooksDir, { recursive: true }) L44: const settingsPath = join(homedir(), '.claude', 'settings.json') L45: let settings = {} ... L53: const dstFile = join(hooksDir, h.dst) L54: copyFileSync(srcFile, dstFile) L55: const targetCmd = `node "${dstFile}"`.replace(/\\/g, '/') ... L68: if (changed) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L10

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node import { existssync, mkdirsync, writefilesync, copyfilesync } from 'fs' import { resolve, dirname, join } from 'path' import { fileurlto

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.mjsView on unpkg

dist/setup/pi-extension.jsView file

24if (!existsSync(join(PI_EXT_DIR, 'node_modules'))) { L25: execSync('npm install --no-audit --no-fund', { cwd: PI_EXT_DIR, stdio: 'ignore', timeout: 300000 }); L26: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup/pi-extension.jsView on unpkg · L24

Source & flagged code

6 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "aifp-mcp",

3 "version": "1.5.2",

4 "description": "AiFP Cognitive Memory — persistent memory MCP server for AI assistants. Chinese-first retrieval with causal chains, Hebbian associations and graph diffusion. 记忆感知系统",

5 "license": "SEE LICENSE IN LICENSE",

6 "type": "module",

7 "main": "dist/index.js",

8 "bin": {

9 "aifp-mcp": "dist/index.js"

10 },

11 "scripts": {

12 "start": "tsx src/index.ts",

13 "server": "tsx src/server.ts",

14 "build": "tsc",

15 "prepublishOnly": "tsc",

16 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "publishConfig": {

19 "access": "public"

20 },

21 "files": [

22 "dist/",

23 "scripts/",

24 "hooks/",

25 "rules/",

26 "README.md",

27 "README.zh.md",

28 "LICENSE",

29 "package.json"

30 ],

31 "dependencies": {

32 "@anthropic-ai/sdk": "^0.39.0",

33 "@modelcontextprotocol/sdk": "^1.29.0",

34 "@xenova/transformers": "^2.17.2"

35 },

36 "optionalDependencies": {

dist/setup/platforms.jsView file

Lines 1-23javascript

1import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';

2import { join, dirname } from 'path';

3import { homedir } from 'os';

4import { execSync } from 'child_process';

scripts/postinstall.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * postinstall — 安装后自动完成全套配置（复用 dist/setup.js 的多平台逻辑）

4 * 1. 配置各 AI 工具的 MCP 连接（Claude Code / Cursor / Windsurf / Cline / Gemini / Qwen / Zed / VS Code / Codex / Trae）

5 * 2. 生成 pi-coding-agent 扩展（~/.pi/agent/extensions/aifp-memory）

6 * 3. 注入启动规则到各 AI 工具的全局规则文件

7 * 4. 注册 Claude Code hooks（SessionStart 状态检测 + UserPromptSubmit 记忆注入）

8 * 只在全局安装时生效（npm install -g aifp-mcp）

9 */

10

11import

dist/setup/pi-extension.jsView file

Lines 4-33javascript

4import { execSync } from 'child_process';

5import { renderIndexTs } from './pi-template.js';

6const PI_EXT_DIR = join(homedir(), '.pi', 'agent',