Loading npm security reports…

chron-mcp@0.1.53: AI-agent control-surface risk | LPM Firewall

registry / chron-mcp / 0.1.53

chron-mcp@0.1.53

Audit-grade timestamped logs for every AI conversation

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package silently installs MCP configuration, AI-agent instructions, and a shell wrapper. The injected instructions require logging exact user and assistant content every turn.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Future Claude, Codex, Cursor, and Gemini sessions are redirected to package-controlled logging behavior without consent.

Mechanism

broad AI-agent control-surface mutation and shell persistence

Policy narrative

Installing the package invokes `setup` automatically. That setup registers `npx -y chron-mcp` as an MCP server, writes mandatory instructions directing agents to log exact user and assistant content, and modifies shell startup files so future Codex invocations bootstrap project instructions. These mutations span unrelated AI-agent control surfaces and occur without an explicit user command.

Rationale

Concrete postinstall-triggered writes alter broad, foreign AI-agent configuration and shell startup surfaces. The absence of a hardcoded receiver does not mitigate the unconsented control hijack.

Evidence

package.jsondist/cli/index.js~/.claude.json~/.codex/config.toml~/AGENTS.md~/.zshrc~/.bashrc

Decision evidence

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery { Rich runtime records forwarded to the sender in dist/index.js: logQuery(query, params) { logQuery() { this.logger.logQuery(this.query.sql, params); logger.logQuery(query.sql, params); logger.logQuery(query.sql, params); this.logger.logQuery(this.query.sql, params); req.body = parse3(str); req.body = req.body || {};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

16555if (!path.startsWith(":")) { L16556: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16557: } ... L17847: }); L17848: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L17849: } ... L19752: ); L19753: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L19754: process.stdout.write( ... L20000: const dir = keysDir(); L20001: (0, import_fs4.mkdirSync)(dir, { recursive: true }); L20002: (0, import_fs4.writeFileSync)(privKeyPath(sessionId), privateKey, { mode: 384 });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L16555

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: function encodeBaseUrl(scheme, authority, path) { var Authorization = { module2.exports = Authorization; var Authorization = require_auth(); module2.exports.Authorization = Authorization; delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

568* ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L568

568Trigger-reachable persistence chain: scripts.postinstall -> dist/cli/index.js L568: * ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli/index.jsView on unpkg · L568

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.52 matchedPath = dist/cli/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.52 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = adc40c57e105c0c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = chron-mcp@0.1.52 matchedPath = dist/cli/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.52 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli/index.jsView on unpkg

22990patternName = generic_password severity = medium line = 22990 matchedText = password...al",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/index.jsView on unpkg · L22990

568* ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L568

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40365try { L40366: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40367: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40365

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.52 matchedPath = dist/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.52 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Source & flagged code

16 flagged

package.jsonView file

Lines 20-60json

20 },

21 "files": [

22 "dist",

23 "skills",

24 ".claude-plugin",

25 "assets",

26 "dashboards",

27 "README.md"

28 ],

29 "engines": {

30 "node": ">=18"

31 },

32 "scripts": {

33 "build": "npx esbuild src/index.ts --bundle --format=cjs --outfile=dist/index.js --platform=node && chmod +x dist/index.js && npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

34 "build:cli": "npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

35 "typecheck": "tsc --noEmit",

36 "dev": "tsc --watch",

37 "start": "node dist/index.js",

38 "test": "vitest run",

39 "test:watch": "vitest",

40 "postinstall": "node dist/cli/index.js setup 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "prepublishOnly": "npm test && npm run build"

42 },

43 "keywords": [

44 "mcp",

45 "ai",

46 "audit",

47 "logging",

48 "claude",

49 "cursor"

50 ],

51 "license": "SEE LICENSE IN LICENSE",

52 "dependencies": {

53 "@libsql/client": "^0.17.3",

54 "@modelcontextprotocol/sdk": "^1.30.0",

55 "drizzle-orm": "^0.45.2",

56 "express": "^4.22.2",

57 "uuid": "^11.1.1",

58 "zod": "^3.22.4"

59 },

60 "devDependencies": {

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery { Rich runtime records forwarded to the sender in dist/index.js: logQuery(query, params) { logQuery() { this.logger.logQuery(this.query.sql, params); logger.logQuery(query.sql, params); logger.logQuery(query.sql, params); this.logger.logQuery(this.query.sql, params); req.body = parse3(str); req.body = req.body || {};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

16555if (!path.startsWith(":")) { L16556: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16557: } ... L17847: }); L17848: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L17849: } ... L19752: ); L19753: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L19754: process.stdout.write( ... L20000: const dir = keysDir(); L20001: (0, import_fs4.mkdirSync)(dir, { recursive: true }); L20002: (0, import_fs4.writeFileSync)(privKeyPath(sessionId), privateKey, { mode: 384 });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L16555

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: function encodeBaseUrl(scheme, authority, path) { var Authorization = { module2.exports = Authorization; var Authorization = require_auth(); module2.exports.Authorization = Authorization; delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40365try { L40366: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40367: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40365

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.52 matchedPath = dist/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.52 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.