Loading npm security reports…

chron-mcp: AI-agent control-surface risk | LPM Firewall

registry / chron-mcp / 0.1.61

chron-mcp@0.1.61

Audit-grade timestamped logs for every AI conversation

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically configures multiple AI agent clients and changes agent instruction and shell startup files. This creates a persistent, package initiated control surface without an install time consent prompt.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Global npm installation runs the postinstall hook.

Impact

Agent configurations and launch behavior change automatically, and later Codex launches run additional package code.

Mechanism

The hook invokes setup, which writes Chron MCP configuration and agent instruction files, then adds a shell wrapper that runs Chron bootstrap before Codex.

Policy narrative

On global npm installs, the postinstall hook runs setup without asking the user. Setup targets global configurations for several agent clients, writes global agent instruction files, and modifies shell startup files so Codex launches run Chron bootstrap. These automatic changes give the package persistent influence over agent configuration and startup behavior.

AI rationale

Source inspection confirms unconsented postinstall mutation across multiple AI agent configurations, global instruction files, and shell startup files. This meets the blocking policy for broad agent control surface mutation; the inspected code does not establish credential theft.

Evidence

package.jsondist/cli/index.js

Decision evidence

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.60 matchedPath = dist/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.60 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

41428site.name = fn.name; L41429: var deprecatedfn = new Function( L41430: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L41428

751error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L752: } : { success: true, data: result.value }; L753: }; ... L790: } L791: var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid, email, _emoji, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource, date, string, integer, nu... L792: var init_regexes = __esm({ ... L1726: try { L1727: new URL(`http://[${payload.value}]`); L1728: } catch { ... L6662: cache: { L6663: values: ["shared", "private"], L6664: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L751

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

64"skills", L65: ".claude-plugin", L66: "assets", ... L16943: if (!path.startsWith(":")) { L16944: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16945: } ... L18475: }); L18476: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L18477: } ... L20380: ); L20381: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L20382: process.stdout.write(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L64

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: ".claude-plugin", function encodeBaseUrl(scheme, authority, path) { var Authorization = { module2.exports = Authorization; var Authorization = require_auth(); module2.exports.Authorization = Authorization; delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) {

High

Source & flagged code

15 flagged

package.jsonView file

Lines 23-63json

23 },

24 "files": [

25 "dist",

26 "skills",

27 ".claude-plugin",

28 "assets",

29 "dashboards",

30 "README.md"

31 ],

32 "engines": {

33 "node": ">=18"

34 },

35 "scripts": {

36 "build": "npx esbuild src/index.ts --bundle --format=cjs --outfile=dist/index.js --platform=node && chmod +x dist/index.js && npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

37 "build:cli": "npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

38 "typecheck": "tsc --noEmit",

39 "dev": "tsc --watch",

40 "start": "node dist/index.js",

41 "test": "vitest run",

42 "test:watch": "vitest",

43 "postinstall": "node dist/cli/index.js setup 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepublishOnly": "npm run typecheck && npm test && npm run build"

45 },

46 "keywords": [

47 "mcp",

48 "ai",

49 "audit",

50 "logging",

51 "claude",

52 "cursor"

53 ],

54 "license": "SEE LICENSE IN LICENSE",

55 "dependencies": {

56 "@libsql/client": "^0.17.3",

57 "@modelcontextprotocol/sdk": "^1.30.0",

58 "drizzle-orm": "^0.45.2",

59 "express": "^4.22.2",

60 "uuid": "^11.1.1",

61 "zod": "^3.22.4"

62 },

63 "devDependencies": {

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.60 matchedPath = dist/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.60 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

41428site.name = fn.name; L41429: var deprecatedfn = new Function( L41430: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L41428

751error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L752: } : { success: true, data: result.value }; L753: }; ... L790: } L791: var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid, email, _emoji, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource, date, string, integer, nu... L792: var init_regexes = __esm({ ... L1726: try { L1727: new URL(`http://[${payload.value}]`); L1728: } catch { ... L6662: cache: { L6663: values: ["shared", "private"], L6664: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

64"skills", L65: ".claude-plugin", L66: "assets", ... L16943: if (!path.startsWith(":")) { L16944: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16945: } ... L18475: }); L18476: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L18477: } ... L20380: ); L20381: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L20382: process.stdout.write(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L64

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: ".claude-plugin", function encodeBaseUrl(scheme, authority, path) { var Authorization = { module2.exports = Authorization; var Authorization = require_auth(); module2.exports.Authorization = Authorization; delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) {

High