Loading npm security reports…

chron-mcp@0.1.58: AI-agent control-surface risk | LPM Firewall

registry / chron-mcp / 0.1.58

chron-mcp@0.1.58

Audit-grade timestamped logs for every AI conversation

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs setup with no prompt and rewrites foreign AI client configs, home instruction files, and shell startup files. Later MCP startup keeps writing project agent rules and can install a Claude session hook.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall runs node dist/cli/index.js setup. A later terminal or stdio start of dist/index.js repeats client setup or project rule writes.

Impact

AI agents load this package and its instructions without a separate user command, and shell startup keeps reapplying project logging rules.

Mechanism

Setup upserts an npx chron-mcp server into Claude, Cursor, Gemini, Codex, and similar configs, appends always-on logging instructions, and wraps codex in .zshrc and .bashrc. The MCP entrypoint can also add a Claude SessionStart hook and rewrite project AGENTS.md and Cursor rules.

Policy narrative

On npm install, postinstall silently runs chron setup. That command writes a Chron MCP server into several users' AI client configs and adds logging instructions under the home directory. It also edits .zshrc and .bashrc so invoking codex first runs chron bootstrap. The registered server is npx -y chron-mcp. When that binary starts in a terminal it configures the same clients and installs a Claude Code SessionStart hook that prints a Chron skill. When an agent starts it over stdio, it writes project AGENTS.md and Cursor rules that require every turn to be logged through Chron.

AI rationale

The postinstall hook mutates broad, foreign AI-agent control surfaces and shell startup files without a user command, and later MCP startup continues that mutation. Silencing setup errors does not change the automatic write.

Evidence

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/cli/index.js setup 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40670try { L40671: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40672: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40670

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.59 matchedPath = dist/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.59 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

41089site.name = fn.name; L41090: var deprecatedfn = new Function( L41091: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L41089

751error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L752: } : { success: true, data: result.value }; L753: }; ... L790: } L791: var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid, email, _emoji, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource, date, string, integer, nu... L792: var init_regexes = __esm({ ... L1726: try { L1727: new URL(`http://[${payload.value}]`); L1728: } catch { ... L6662: cache: { L6663: values: ["shared", "private"], L6664: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L751

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

64"skills", L65: ".claude-plugin", L66: "assets", ... L16644: if (!path.startsWith(":")) { L16645: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16646: } ... L18071: }); L18072: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L18073: } ... L19976: ); L19977: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L19978: process.stdout.write(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L64

•matchType = previous_version_dangerous_delta matchedPackage = chron-mcp@0.1.44 matchedIdentity = npm:Y2hyb24tbWNw:0.1.44 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

Source & flagged code

17 flagged

package.jsonView file

Lines 23-63json

23 },

24 "files": [

25 "dist",

26 "skills",

27 ".claude-plugin",

28 "assets",

29 "dashboards",

30 "README.md"

31 ],

32 "engines": {

33 "node": ">=18"

34 },

35 "scripts": {

36 "build": "npx esbuild src/index.ts --bundle --format=cjs --outfile=dist/index.js --platform=node && chmod +x dist/index.js && npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

37 "build:cli": "npx esbuild src/cli/index.ts --bundle --format=cjs --outfile=dist/cli/index.js --platform=node && chmod +x dist/cli/index.js",

38 "typecheck": "tsc --noEmit",

39 "dev": "tsc --watch",

40 "start": "node dist/index.js",

41 "test": "vitest run",

42 "test:watch": "vitest",

43 "postinstall": "node dist/cli/index.js setup 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepublishOnly": "npm run typecheck && npm test && npm run build"

45 },

46 "keywords": [

47 "mcp",

48 "ai",

49 "audit",

50 "logging",

51 "claude",

52 "cursor"

53 ],

54 "license": "SEE LICENSE IN LICENSE",

55 "dependencies": {

56 "@libsql/client": "^0.17.3",

57 "@modelcontextprotocol/sdk": "^1.30.0",

58 "drizzle-orm": "^0.45.2",

59 "express": "^4.22.2",

60 "uuid": "^11.1.1",

61 "zod": "^3.22.4"

62 },

63 "devDependencies": {

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40670try { L40671: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40672: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40670

•matchType = normalized_sha256 matchedPackage = chron-mcp@0.1.59 matchedPath = dist/index.js matchedIdentity = npm:Y2hyb24tbWNw:0.1.59 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

64"skills", L65: ".claude-plugin", L66: "assets", ... L16644: if (!path.startsWith(":")) { L16645: (0, import_fs.mkdirSync)((0, import_path.dirname)(path), { recursive: true }); L16646: } ... L18071: }); L18072: (0, import_fs2.writeFileSync)(outputPath, html, "utf8"); L18073: } ... L19976: ); L19977: (0, import_fs3.writeFileSync)(outputPath, html, "utf8"); L19978: process.stdout.write(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/index.jsView on unpkg · L64

•matchType = previous_version_dangerous_delta matchedPackage = chron-mcp@0.1.44 matchedIdentity = npm:Y2hyb24tbWNw:0.1.44 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.