Loading npm security reports…

cielara-enterprise@0.1.41: AI-agent control-surface risk | LPM Firewall

registry / cielara-enterprise / 0.1.41

cielara-enterprise@0.1.41

Cielara Enterprise MCP connector — installs an MCP server for Claude, Codex, and Cursor that connects to the Cielara knowledge graph, agent memory, and world model, plus the code-graph sidecar, skills, and grep enrichment hooks.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Interactive npm postinstall mutates multiple third-party AI-agent configuration directories without an explicit setup command. It registers an MCP server that launches this package through npx; later runtime telemetry sends device and usage data to the vendor portal.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install in an interactive terminal (or npm install with --yes).

Impact

Codex, Claude Code, and Cursor can automatically launch the package MCP server; collected device/usage metadata may be transmitted to the portal.

Mechanism

postinstall AI-agent MCP configuration injection and default telemetry collection

Policy narrative

On a normal interactive install, postinstall calls install() with the default target set, which writes Cielara MCP server entries into Codex, Claude Code, and Cursor user configuration and copies skills. Those entries execute `npx -y cielara-enterprise mcp` when the agent client starts. Separately, runtime telemetry buffers identifying device and usage fields and posts them to the configured portal, defaulting to cielaracode.com.

Rationale

Source confirms an unconsented npm postinstall mutation of broad foreign AI-agent control surfaces. This meets the blocking install-control-surface policy independently of the telemetry concern.

Evidence

package.jsonscripts/postinstall.jslib/install.jslib/telemetry.jsskills/cielara-usage/SKILL.md~/.codex/config.toml~/.claude.json~/.cursor/mcp.json~/.codex/skills

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cielara-code.jsView file

13L14: const { spawnSync } = require('child_process'); L15: const { getBinary } = require('../lib/cielara');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cielara-code.jsView on unpkg · L13

lib/telemetry.jsView file

6Source sends the broad process environment to a literal external destination. L6: const path = require('path'); L7: const { spawn, spawnSync } = require('child_process'); L8: const { configDir, readConfig, activeConnection, captureQueryEnabled, deviceLabel } = require('./config'); ... L18: const FLUSHER_PID_FILE = path.join(configDir(), '.telemetry-flusher.pid'); L19: const MAX_BUFFER_BYTES = Number(process.env.CIELARA_TELEMETRY_MAX_BYTES || 50 * 1024 * 1024); L20: const MAX_BATCH_EVENTS = 500; ... L26: try { L27: pkgVersion = require('../package.json').version || pkgVersion; L28: } catch {} ... L35: try { L36: return JSON.parse(fs.readFileSync(INSTALL_STATE_FILE, 'utf8')); L37: } catch {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/telemetry.jsView on unpkg · L6

lib/install.jsView file

76function writeJSON(file, value) { L77: fs.mkdirSync(path.dirname(file), { recursive: true }); L78: fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`); L79: } ... L82: const data = readJSON(file); L83: data.mcpServers = data.mcpServers || {}; L84: data.mcpServers.cielara = mcpServerJSON(options); L85: writeJSON(file, data); ... L132: function installCodex(options = {}) { L133: const file = path.join(os.homedir(), '.codex', 'config.toml'); L134: fs.mkdirSync(path.dirname(file), { recursive: true }); L135: const current = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.jsView on unpkg · L76

cielara/linux-arm64/leiden_helperView file

•path = cielara/linux-arm64/leiden_helper kind = native_binary sizeBytes = 2902104 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

cielara/linux-arm64/leiden_helperView on unpkg

python/memory_mcp/server.pyView file

•path = python/memory_mcp/server.py kind = build_helper sizeBytes = 37509 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/memory_mcp/server.pyView on unpkg