Loading npm security reports…

codesift-mcp@0.17.0: Malicious npm security report (Block) | LPM Firewall

registry / codesift-mcp / 0.17.0

codesift-mcp@0.17.0

MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package automatically alters global AI-agent configuration and Git hook behavior. It registers package commands as persistent hooks and configures its MCP server across multiple client platforms.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation.

Impact

Future AI-client and Git activity can invoke package-controlled commands without an explicit setup command from the user.

Mechanism

Automatic cross-platform agent configuration and global Git hook installation.

Attack narrative

On installation, the postinstall hook executes `codesift setup all`. That command defaults to enabling agent hooks and Git hooks, then configures all supported clients. The Claude setup writes commands into global hook settings; the Codex setup creates a required MCP server with automatic tool approval. The installer also sets Git’s global hooks path to package-managed files. This is an unconsented install-time mutation of broad AI-agent control surfaces and persistence across later client and Git use.

AI rationale

The package’s postinstall performs broad, persistent AI-agent and Git configuration without an explicit user setup action. This meets the install-hook abuse blocking policy.

Evidence

package.jsondist/cli/commands-admin.jsdist/cli/setup/claude.jsdist/cli/setup/codex.jsdist/cli/git-hooks-installer.js~/.claude/settings.json~/.codex/config.toml~/.claude/hooks/post-commit

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/cli.js setup all 2>/dev/null && echo ' ✨ CodeSift MCP installed and configured for all platforms. ⚠️ Restart your AI client (Cmd+Q for Claude Code) to load new MCP...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/cli.js setup all 2>/dev/null && echo ' ✨ CodeSift MCP installed and configured for all platforms. ⚠️ Restart your AI client (Cmd+Q for Claude Code) to load new MCP...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/tools/pg-introspection.jsView file

13const pgSpecifier = "pg"; L14: const mod = (await import(/* @vite-ignore */ pgSpecifier)); L15: // Handle both ESM default-export and CJS named-export shapes.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/pg-introspection.jsView on unpkg · L13

dist/tools/index-tools/snapshots.jsView file

118const raw = await readFile(versionsPath, "utf-8"); L119: storedVersions = JSON.parse(raw); L120: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/index-tools/snapshots.jsView on unpkg · L118

dist/cli/service.jsView file

6Trigger-reachable persistence chain: scripts.postinstall -> dist/cli.js -> dist/cli/commands.js -> dist/cli/commands-admin.js -> dist/cli/service.js L6: import { fileURLToPath } from "node:url"; L7: import { execFileSync } from "node:child_process"; L8: /** ... L66: export function buildServicePlan(opts) { L67: const home = opts.home ?? homedir(); L68: const os = opts.os ?? platform(); ... L83: unitPath, L84: stdoutLog: join(logDir, "daemon.out.log"), L85: stderrLog: join(logDir, "daemon.err.log"), ... L132: */ L133: export function resolveDaemonHeapMb(totalRamBytes, env = process.env) { L134: const override = Number(env["CODESIFT_DAEMON_HEAP_MB"]);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli/service.jsView on unpkg · L6

6import { fileURLToPath } from "node:url"; L7: import { execFileSync } from "node:child_process"; L8: /** ... L66: export function buildServicePlan(opts) { L67: const home = opts.home ?? homedir(); L68: const os = opts.os ?? platform(); ... L83: unitPath, L84: stdoutLog: join(logDir, "daemon.out.log"), L85: stderrLog: join(logDir, "daemon.err.log"), ... L132: */ L133: export function resolveDaemonHeapMb(totalRamBytes, env = process.env) { L134: const override = Number(env["CODESIFT_DAEMON_HEAP_MB"]);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/service.jsView on unpkg · L6

dist/cli/setup/codex-project-auto.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L21: async function globalCodexEntryIsHttp(home) { L22: const globalToml = join(home, ".codex", "config.toml"); L23: if (!existsSync(globalToml)) ... L40: /** L41: * Write `<root>/.codex/config.toml` when — and only when — it is safe and useful. L42: * ... L62: // the front-loaded surface the global entry was fixed to provide. L63: const projectToml = join(root, ".codex", "config.toml"); L64: if (existsSync(projectToml)) { ... L82: } L83: if (!existsSync(join(home, ".codex"))) L84: return "sk[redacted]"; Write operation from dist/storage/_shared.js: L81: const dir = dirname(targetPath); L82: await mkdir(dir, { recursive: true }); L83: // pid + random: Date.now() alone collides when two writers (parallel test ... L108: c

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/setup/codex-project-auto.jsView on unpkg · L1

dist/cli/git-hooks-installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function resolvebundledhooksdir() { const here = dirname(fileurltopath(import.meta.url)); const candidates = [ join(here, "..", "..", "hooks"), join(here, "..", "..", "..", "hooks"), ]; for (const c of candidates) { if (existssync(c)) return c; } throw new error(`bundled hooks directory not found. looked in: ${candidates.join(", ")}`); } function sha256(content) { return createhash("sha256").update(content).digest("hex"); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/git-hooks-installer.jsView on unpkg

dist/parser/languages/tree-sitter-go.wasmView file

•path = dist/parser/languages/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parser/languages/tree-sitter-go.wasmView on unpkg

hooks/hook-chain.shView file

•path = hooks/hook-chain.sh kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook-chain.shView on unpkg

dist/cli/commands-index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/commands-index.js#virtual:normalized:round1View on unpkg

dist/tools/project-profile-extractors.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.15.3 matchedPath = dist/tools/project-profile-extractors.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.15.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/project-profile-extractors.jsView on unpkg

dist/lsp/lsp-tools.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.14.0 matchedPath = dist/lsp/lsp-tools.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lsp/lsp-tools.jsView on unpkg

dist/tools/dependency-audit-freshness-tools.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.15.3 matchedPath = dist/tools/dependency-audit-freshness-tools.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.15.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/dependency-audit-freshness-tools.jsView on unpkg

dist/tools/dependency-audit-vulnerability-tools.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.15.3 matchedPath = dist/tools/dependency-audit-vulnerability-tools.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.15.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/dependency-audit-vulnerability-tools.jsView on unpkg

dist/tools/insights-tools.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.15.3 matchedPath = dist/tools/insights-tools.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.15.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/insights-tools.jsView on unpkg

dist/tools/migration-lint-tools.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.15.3 matchedPath = dist/tools/migration-lint-tools.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.15.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/migration-lint-tools.jsView on unpkg

dist/tools/async-correctness.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.15.3 matchedPath = dist/tools/async-correctness.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.15.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/async-correctness.jsView on unpkg