Loading npm security reports…

aifp-mcp@1.5.3: AI-agent control-surface risk | LPM Firewall

registry / aifp-mcp / 1.5.3

aifp-mcp@1.5.3

AiFP Cognitive Memory — persistent memory MCP server for AI assistants. Chinese-first retrieval with causal chains, Hebbian associations and graph diffusion. 记忆感知系统

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package invokes configuration that persists a local MCP server, global agent instructions, and Claude hooks across detected third-party AI tools. This is unconsented install-time expansion of AI-agent control surfaces.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install, including global installation

Impact

Future agent sessions may automatically execute the package server, run copied hooks, and follow injected memory instructions.

Mechanism

postinstall auto-configures foreign AI-agent configs, rules, hooks, and a Pi extension

Policy narrative

At npm postinstall, the package calls configureAll without a user command. It detects installed AI tools and writes MCP configuration pointing to its executable, injects global agent instructions, registers Claude hooks that process prompts, and may create a Pi extension then invoke npm install. These durable changes affect multiple foreign agent control surfaces and cause future sessions to load package-controlled behavior.

Rationale

The lifecycle hook concretely performs broad, unconsented AI-agent configuration and persistence, meeting the blocking policy regardless of the absence of a bundled remote endpoint.

Evidence

package.jsonscripts/postinstall.mjsdist/setup/index.jsdist/setup/platforms.jsdist/setup/pi-extension.js~/.claude/settings.json~/.claude/hooks/check-aifp-status.mjs~/.claude/hooks/recall-aifp-memory.mjs

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/setup/platforms.jsView file

3import { homedir } from 'os'; L4: import { execSync } from 'child_process'; L5: const HOME = homedir();

High

Child Process

Package source references child process execution.

dist/setup/platforms.jsView on unpkg · L3

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. \/g, '\\\\')).join('", "'); toml += `\n[mcp_servers.ai-cognition]\ncommand = "${s.command}"\nargs = ["${args}"]\n`; writefilesync(p, toml, 'utf-8'); return 'ok'; } catch { return 'error'; } }, }, { id: 'dsh', name: 'deepseek harness (dsh)', detected: () => existssync(join(home, '.dsh')), configure: (s) => { const p = join(home, '.dsh', 'cordis.patch.yml'); try { mkdirsync(dirname(p), { recursive: true }); let yaml = ''; try { yaml = readfilesync(p, 'u

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/setup/platforms.jsView on unpkg

scripts/postinstall.mjsView file

10L11: import { existsSync, mkdirSync, writeFileSync, copyFileSync } from 'fs' L12: import { resolve, dirname, join } from 'path' ... L43: try { L44: const hooksDir = join(homedir(), '.claude', 'hooks') L45: mkdirSync(hooksDir, { recursive: true }) L46: const settingsPath = join(homedir(), '.claude', 'settings.json') L47: let settings = {} ... L55: const dstFile = join(hooksDir, h.dst) L56: copyFileSync(srcFile, dstFile) L57: const targetCmd = `node "${dstFile}"`.replace(/\\/g, '/') ... L70: if (changed) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L10

dist/setup/pi-extension.jsView file

24if (!existsSync(join(PI_EXT_DIR, 'node_modules'))) { L25: execSync('npm install --no-audit --no-fund', { cwd: PI_EXT_DIR, stdio: 'ignore', timeout: 300000 }); L26: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup/pi-extension.jsView on unpkg · L24

Source & flagged code

6 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "aifp-mcp",

3 "version": "1.5.3",

4 "description": "AiFP Cognitive Memory — persistent memory MCP server for AI assistants. Chinese-first retrieval with causal chains, Hebbian associations and graph diffusion. 记忆感知系统",

5 "license": "SEE LICENSE IN LICENSE",

6 "type": "module",

7 "main": "dist/index.js",

8 "bin": {

9 "aifp-mcp": "dist/index.js"

10 },

11 "scripts": {

12 "start": "tsx src/index.ts",

13 "server": "tsx src/server.ts",

14 "build": "tsc",

15 "prepublishOnly": "tsc",

16 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "build:server": "tsc -p tsconfig.server.json",

18 "start:server": "node dist-server/server.js"

19 },

20 "publishConfig": {

21 "access": "public"

22 },

23 "files": [

24 "dist/",

25 "scripts/",

26 "hooks/",

27 "rules/",

28 "README.md",

29 "LICENSE",

30 "package.json"

31 ],

32 "dependencies": {

33 "@anthropic-ai/sdk": "^0.39.0",

34 "@modelcontextprotocol/sdk": "^1.29.0",

35 "@xenova/transformers": "^2.17.2"

36 },

dist/setup/platforms.jsView file

Lines 1-23javascript

1import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';

2import { join, dirname } from 'path';

3import { homedir } from 'os';

4import { execSync } from 'child_process';

scripts/postinstall.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * postinstall — 安装后自动完成全套配置（复用 dist/setup.js 的多平台逻辑）

4 * 1. 配置各 AI 工具的 MCP 连接（Claude Code / Cursor / Windsurf / Cline / Gemini / Qwen / Zed / VS Code / Codex / Trae）

5 * 2. 生成 pi-coding-agent 扩展（~/.pi/agent/extensions/aifp-memory）

6 * 3. 注入启动规则到各 AI 工具的全局规则文件

7 * 4. 注册 Claude Code hooks（SessionStart 状态检测 + UserPromptSubmit 记忆注入）

8 * 只在全局安装时生效（npm install -g aifp-mcp）

9 */

10

11import

dist/setup/pi-extension.jsView file

Lines 4-33javascript

4import { execSync } from 'child_process';

5import { renderIndexTs } from './pi-template.js';

6const PI_EXT_DIR = join(homedir(), '.pi', 'agent',