chron-mcp@0.1.52: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

chron-mcp@0.1.52: AI-agent control-surface risk | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery { Rich runtime records forwarded to the sender in dist/index.js: logQuery(query, params) { logQuery() { this.logger.logQuery(this.query.sql, params); logger.logQuery(query.sql, params); logger.logQuery(query.sql, params); this.logger.logQuery(this.query.sql, params); req.body = parse3(str); req.body = req.body || {};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

16555if (!path.startsWith(":")) { L16556: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16557: } ... L17847: }); L17848: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L17849: } ... L19752: ); L19753: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L19754: process.stdout.write( ... L20000: const dir = keysDir(); L20001: (0, import_fs4.mkdirSync)(dir, { recursive: true }); L20002: (0, import_fs4.writeFileSync)(privKeyPath(sessionId), privateKey, { mode: 384 });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L16555

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: function encodeBaseUrl(scheme, authority, path) { var Authorization = { module2.exports = Authorization; var Authorization = require_auth(); module2.exports.Authorization = Authorization; delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

568* ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L568

568Trigger-reachable persistence chain: scripts.postinstall -> dist/cli/index.js L568: * ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli/index.jsView on unpkg · L568

22990patternName = generic_password severity = medium line = 22990 matchedText = password...al",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/index.jsView on unpkg · L22990

568* ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L568

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40365try { L40366: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40367: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40365

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

751error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L752: } : { success: true, data: result.value }; L753: }; ... L790: } L791: var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid, email, _emoji, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource, date, string, integer, nu... L792: var init_regexes = __esm({ ... L1726: try { L1727: new URL(`http://[${payload.value}]`); L1728: } catch { ... L6662: cache: { L6663: values: ["shared", "private"], L6664: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

Source & flagged code

13 flagged

package.jsonView file

Lines 20-60json

20 },

21 "files": [

22 "dist",

23 "skills",

24 ".claude-plugin",

25 "assets",

26 "dashboards",

27 "README.md"

28 ],

29 "engines": {

30 "node": ">=18"

31 },

32 "scripts": {

33 "build": "npx esbuild src/index.ts --bundle --format=cjs --outfile=dist/index.js --platform=node && chmod +x dist/index.js && npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

34 "build:cli": "npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

35 "typecheck": "tsc --noEmit",

36 "dev": "tsc --watch",

37 "start": "node dist/index.js",

38 "test": "vitest run",

39 "test:watch": "vitest",

40 "postinstall": "node dist/cli/index.js setup 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "prepublishOnly": "npm test && npm run build"

42 },

43 "keywords": [

44 "mcp",

45 "ai",

46 "audit",

47 "logging",

48 "claude",

49 "cursor"

50 ],

51 "license": "SEE LICENSE IN LICENSE",

52 "dependencies": {

53 "@libsql/client": "^0.17.3",

54 "@modelcontextprotocol/sdk": "^1.30.0",

55 "drizzle-orm": "^0.45.2",

56 "express": "^4.22.2",

57 "uuid": "^11.1.1",

58 "zod": "^3.22.4"

59 },

60 "devDependencies": {

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery { Rich runtime records forwarded to the sender in dist/index.js: logQuery(query, params) { logQuery() { this.logger.logQuery(this.query.sql, params); logger.logQuery(query.sql, params); logger.logQuery(query.sql, params); this.logger.logQuery(this.query.sql, params); req.body = parse3(str); req.body = req.body || {};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

16555if (!path.startsWith(":")) { L16556: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16557: } ... L17847: }); L17848: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L17849: } ... L19752: ); L19753: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L19754: process.stdout.write( ... L20000: const dir = keysDir(); L20001: (0, import_fs4.mkdirSync)(dir, { recursive: true }); L20002: (0, import_fs4.writeFileSync)(privKeyPath(sessionId), privateKey, { mode: 384 });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L16555

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: function encodeBaseUrl(scheme, authority, path) { var Authorization = { module2.exports = Authorization; var Authorization = require_auth(); module2.exports.Authorization = Authorization; delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40365try { L40366: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40367: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40365

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

751error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L752: } : { success: true, data: result.value }; L753: }; ... L790: } L791: var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid, email, _emoji, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource, date, string, integer, nu... L792: var init_regexes = __esm({ ... L1726: try { L1727: new URL(`http://[${payload.value}]`); L1728: } catch { ... L6662: cache: { L6663: values: ["shared", "private"], L6664: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)