Loading npm security reports…

aifp-mcp@1.5.4: AI-agent control-surface risk | LPM Firewall

registry / aifp-mcp / 1.5.4

aifp-mcp@1.5.4

AiFP Cognitive Memory — persistent memory MCP server for AI assistants. Chinese-first retrieval with causal chains, Hebbian associations and graph diffusion. 记忆感知系统

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm postinstall, the package mutates detected third-party AI-agent configurations, injects Claude hooks, and generates a pi extension. The pi extension captures user prompts and can use a key read from pi's auth file to send those prompts to DeepSeek.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install (postinstall), then AI-agent startup/session activity.

Impact

Unconsented persistence in AI tools, credential reuse, and exfiltration of user prompts.

Mechanism

install-time AI-agent configuration and hook injection with prompt capture and LLM submission

Policy narrative

Installing the package invokes setup without user confirmation. It configures detected AI tools and adds Claude hooks; for pi it writes an extension that reads the local DeepSeek credential, captures the latest user message at agent end, and queues it. The enabled recognizer builds prompts from queued messages and calls the configured LLM, which the generated extension defaults to DeepSeek using the harvested credential.

Rationale

This is a concrete unconsented postinstall mutation of broad third-party AI-agent control surfaces combined with credential reuse and prompt exfiltration. It meets the package firewall block boundary.

Evidence

scripts/postinstall.mjsdist/setup/platforms.jsdist/setup/pi-template.jsdist/recognizer.js~/.claude/settings.json~/.claude/hooks/check-aifp-status.mjs~/.claude/hooks/recall-aifp-memory.mjs~/.cursor/mcp.json

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/setup/platforms.jsView file

3import { homedir } from 'os'; L4: import { execSync } from 'child_process'; L5: const HOME = homedir();

High

Child Process

Package source references child process execution.

dist/setup/platforms.jsView on unpkg · L3

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const args = s.args.map((a) => a.replace(/\\/g, '\\\\')).join('", "'); toml += `\n[mcp_servers.ai-cognition]\ncommand = "${s.command}"\nargs = ["${args}"]\n`; writefilesync(p, toml, 'utf-8'); return 'ok'; } catch { return 'error'; } }, }, { id: 'dsh', name: 'deepseek harness (dsh)', detected: () => existssync(join(home, '.dsh')), configure: (s) => { const p = join(home, '.dsh', 'cordis.patch.yml'); try { mkdirsync(dirname(p), { recursive: true }); let yaml = ''; try {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/setup/platforms.jsView on unpkg

scripts/postinstall.mjsView file

10L11: import { existsSync, mkdirSync, writeFileSync, copyFileSync } from 'fs' L12: import { resolve, dirname, join } from 'path' ... L43: try { L44: const hooksDir = join(homedir(), '.claude', 'hooks') L45: mkdirSync(hooksDir, { recursive: true }) L46: const settingsPath = join(homedir(), '.claude', 'settings.json') L47: let settings = {} ... L55: const dstFile = join(hooksDir, h.dst) L56: copyFileSync(srcFile, dstFile) L57: const targetCmd = `node "${dstFile}"`.replace(/\\/g, '/') ... L70: if (changed) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L10

dist/setup/pi-extension.jsView file

24if (!existsSync(join(PI_EXT_DIR, 'node_modules'))) { L25: execSync('npm install --no-audit --no-fund', { cwd: PI_EXT_DIR, stdio: 'ignore', timeout: 300000 }); L26: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup/pi-extension.jsView on unpkg · L24

Source & flagged code

6 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "aifp-mcp",

3 "version": "1.5.4",

4 "description": "AiFP Cognitive Memory — persistent memory MCP server for AI assistants. Chinese-first retrieval with causal chains, Hebbian associations and graph diffusion. 记忆感知系统",

5 "license": "SEE LICENSE IN LICENSE",

6 "type": "module",

7 "main": "dist/index.js",

8 "bin": {

9 "aifp-mcp": "dist/index.js"

10 },

11 "scripts": {

12 "start": "tsx src/index.ts",

13 "server": "tsx src/server.ts",

14 "build": "tsc",

15 "prepublishOnly": "tsc",

16 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "build:server": "tsc -p tsconfig.server.json",

18 "start:server": "node dist-server/server.js"

19 },

20 "publishConfig": {

21 "access": "public"

22 },

23 "files": [

24 "dist/",

25 "scripts/",

26 "hooks/",

27 "rules/",

28 "README.md",

29 "LICENSE",

30 "package.json"

31 ],

32 "dependencies": {

33 "@anthropic-ai/sdk": "^0.39.0",

34 "@modelcontextprotocol/sdk": "^1.29.0",

35 "@xenova/transformers": "^2.17.2"

36 },

dist/setup/platforms.jsView file

Lines 1-23javascript

1import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';

2import { join, dirname } from 'path';

3import { homedir } from 'os';

4import { execSync } from 'child_process';

scripts/postinstall.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * postinstall — 安装后自动完成全套配置（复用 dist/setup.js 的多平台逻辑）

4 * 1. 配置各 AI 工具的 MCP 连接（Claude Code / Cursor / Windsurf / Cline / Gemini / Qwen / Zed / VS Code / Codex / Trae）

5 * 2. 生成 pi-coding-agent 扩展（~/.pi/agent/extensions/aifp-memory）

6 * 3. 注入启动规则到各 AI 工具的全局规则文件

7 * 4. 注册 Claude Code hooks（SessionStart 状态检测 + UserPromptSubmit 记忆注入）

8 * 只在全局安装时生效（npm install -g aifp-mcp）

9 */

10

11import

dist/setup/pi-extension.jsView file

Lines 4-33javascript

4import { execSync } from 'child_process';

5import { renderIndexTs } from './pi-template.js';

6const PI_EXT_DIR = join(homedir(), '.pi', 'agent',