Loading npm security reports…

chron-mcp@0.1.55: AI-agent control-surface risk | LPM Firewall

registry / chron-mcp / 0.1.55

chron-mcp@0.1.55

Audit-grade timestamped logs for every AI conversation

AI Security Review

scanned 24d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently modifies global AI-client configuration, AI instruction files, and shell startup files. These changes cause future agent and Codex sessions to use Chron logging.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the postinstall hook.

Impact

It can alter the behavior and instruction context of multiple AI tools without user consent.

Mechanism

Automatic broad AI-agent configuration and shell-wrapper persistence.

Policy narrative

On installation, the package invokes its setup command. Setup creates or edits MCP configuration for several global AI clients, writes instructions requiring every AI exchange to be logged, and modifies both common shell startup files to intercept Codex launches. It also configures the MCP server as an unpinned npx invocation. This is an unconsented, install-time mutation of broad AI-agent control surfaces and persistence locations.

AI rationale

The package has a registry-install postinstall hook that automatically changes multiple foreign AI-agent control surfaces and shell profiles. This meets the install-hook abuse boundary regardless of the absence of a fixed exfiltration endpoint in the setup path.

Evidence

package.jsondist/cli/index.js~/.claude.json~/.cursor/mcp.json~/.gemini/settings.json~/.codex/config.toml~/.codex/instructions.md~/AGENTS.md

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

16555if (!path.startsWith(":")) { L16556: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16557: } ... L17890: }); L17891: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L17892: } ... L19795: ); L19796: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L19797: process.stdout.write( ... L20043: const dir = keysDir(); L20044: (0, import_fs4.mkdirSync)(dir, { recursive: true }); L20045: (0, import_fs4.writeFileSync)(privKeyPath(sessionId), privateKey, { mode: 384 });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L16555

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: function encodeBaseUrl(scheme, authority, path) { var Authorization = { module2.exports = Authorization; var Authorization = require_auth(); module2.exports.Authorization = Authorization; delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

568* ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L568

568Trigger-reachable persistence chain: scripts.postinstall -> dist/cli/index.js L568: * ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli/index.jsView on unpkg · L568

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.53 matchedPath = dist/cli/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = adc40c57e105c0c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = chron-mcp@0.1.53 matchedPath = dist/cli/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.53 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli/index.jsView on unpkg

23059patternName = generic_password severity = medium line = 23059

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/index.jsView on unpkg · L23059

568* ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L568

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40451try { L40452: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40453: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40451

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.56 matchedPath = dist/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.56 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Source & flagged code

16 flagged

package.jsonView file

Lines 20-60json

20 },

21 "files": [

22 "dist",

23 "skills",

24 ".claude-plugin",

25 "assets",

26 "dashboards",

27 "README.md"

28 ],

29 "engines": {

30 "node": ">=18"

31 },

32 "scripts": {

33 "build": "npx esbuild src/index.ts --bundle --format=cjs --outfile=dist/index.js --platform=node && chmod +x dist/index.js && npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

34 "build:cli": "npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

35 "typecheck": "tsc --noEmit",

36 "dev": "tsc --watch",

37 "start": "node dist/index.js",

38 "test": "vitest run",

39 "test:watch": "vitest",

40 "postinstall": "node dist/cli/index.js setup 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "prepublishOnly": "npm test && npm run build"

42 },

43 "keywords": [

44 "mcp",

45 "ai",

46 "audit",

47 "logging",

48 "claude",

49 "cursor"

50 ],

51 "license": "SEE LICENSE IN LICENSE",

52 "dependencies": {

53 "@libsql/client": "^0.17.3",

54 "@modelcontextprotocol/sdk": "^1.30.0",

55 "drizzle-orm": "^0.45.2",

56 "express": "^4.22.2",

57 "uuid": "^11.1.1",

58 "zod": "^3.22.4"

59 },

60 "devDependencies": {

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

16555if (!path.startsWith(":")) { L16556: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16557: } ... L17890: }); L17891: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L17892: } ... L19795: ); L19796: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L19797: process.stdout.write( ... L20043: const dir = keysDir(); L20044: (0, import_fs4.mkdirSync)(dir, { recursive: true }); L20045: (0, import_fs4.writeFileSync)(privKeyPath(sessionId), privateKey, { mode: 384 });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L16555

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: function encodeBaseUrl(scheme, authority, path) { var Authorization = { module2.exports = Authorization; var Authorization = require_auth(); module2.exports.Authorization = Authorization; delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40451try { L40452: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40453: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40451

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.56 matchedPath = dist/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.56 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.