Loading npm security reports…

brokre@0.2.25: AI-agent control-surface risk | LPM Firewall

registry / brokre / 0.2.25

brokre@0.2.25

MCP launcher for brokre — local credential broker for Cursor, Claude Code, Kimi Code, Trae, OpenClaw, Hermes Agent, ChatClaw, and other MCP clients

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies global MCP settings for detected AI clients. Those settings launch brokre through npx and select the latest registry release at future client startup.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes the postinstall lifecycle hook.

Impact

Installed AI clients can automatically run a remotely updated brokre package, without an explicit setup command from the user.

Mechanism

Postinstall MCP configuration injection across multiple AI-client profiles.

Policy narrative

The npm postinstall hook runs setup-mcp.js. It detects several installed AI clients and writes global MCP configuration entries that execute npx -y brokre@latest. This mutates a broad foreign AI-agent control surface during installation and causes future client starts to resolve and execute a registry-selected release.

Rationale

This is an unconsented postinstall mutation of multiple foreign AI-agent configuration surfaces. The injected latest-version npx command adds a continuing remote execution path.

Evidence

package.jsonsetup-mcp.js~/.cursor/mcp.json~/Library/Application Support/Code/User/mcp.json~/.claude.json~/.kimi-code/mcp.json~/.codeium/windsurf/mcp_config.json~/.openclaw/openclaw.json

Decision evidence

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node setup-mcp.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

index.jsView file

9Trigger-reachable persistence chain: manifest.main -> index.js L9: L10: const { spawn, execFileSync } = require('child_process'); L11: const fs = require('fs'); L12: const http = require('http'); L13: const https = require('https'); ... L17: L18: const { version: PKG_VERSION } = require('./package.json'); L19: const REPO = 'Furowu/brokre'; ... L48: }); L49: process.stdout.write(out.endsWith('\n') ? out : `${out}\n`); L50: process.exit(0); ... L82: function findBrokreOnPath() {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

index.jsView on unpkg · L9

9L10: const { spawn, execFileSync } = require('child_process'); L11: const fs = require('fs'); L12: const http = require('http'); L13: const https = require('https'); ... L17: L18: const { version: PKG_VERSION } = require('./package.json'); L19: const REPO = 'Furowu/brokre'; ... L48: }); L49: process.stdout.write(out.endsWith('\n') ? out : `${out}\n`); L50: process.exit(0); ... L82: function findBrokreOnPath() {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

index.jsView on unpkg · L9

setup-mcp.jsView file

142function writeJsonFile(filePath, data) { L143: fs.mkdirSync(path.dirname(filePath), { recursive: true }); L144: if (pathExists(filePath)) { L145: const backup = `${filePath}.brokre.bak`; L146: fs.copyFileSync(filePath, backup); L147: } L148: fs.writeFileSync(filePath, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 }); L149: } L150: L151: function mergeMcpServers(data, serversKey, entry, options = {}) { L152: const next = data && typeof data === 'object' ? { ...data } : {}; ... L208: function isClaudeCodeInstalled() {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup-mcp.jsView on unpkg · L142