registry / AI-agent control-surface risk / gossipcat
gossipcat
Multi-agent orchestration for Claude Code — parallel review, consensus, adaptive dispatch
This report shows the evidence for gossipcat@0.8.1. 3 of 7 known versions are blocked or flagged. The newest version, 0.9.1, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic lifecycle hook modifies a consumer-owned MCP configuration rather than only package-owned files. That creates an unconsented agent-extension execution path.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation runs postinstall.
Impact
A package installation changes a broad AI-agent control surface and can cause the bundled server to run in the consumer project.
Mechanism
Writes a gossipcat command into the consumer .mcp.json file.
Policy narrative
On npm install, package.json runs scripts/postinstall.js. For a local dependency, that script walks upward from node_modules to locate the consumer project and writes or merges its .mcp.json. The inserted entry starts dist-mcp/mcp-server.js with Node, registering the package as an MCP server without an explicit setup command. This is an unconsented install-time mutation of a consumer AI-agent control surface.
AI rationale
The automatic lifecycle hook modifies a consumer-owned MCP configuration rather than only package-owned files. That creates an unconsented agent-extension execution path.
Evidence
package.jsonscripts/postinstall.js.mcp.jsondist-mcp/mcp-server.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest automatically runs a postinstall script.
- The script walks out of node_modules to select the consumer project root.
- It writes a .mcp.json entry that launches the package's server with Node.
Evidence against
- The inspected install script does not send data over the network.
- No runtime self-dependency is declared.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
dist-mcp/mcp-server.js3.53 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsEvalHighEntropyStringsUrlStringsraw.githubusercontent.com
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist-dashboard/assets/index-D6uFFy4M.jsView file
8`+e.stack}}var Se=Object.prototype.hasOwnProperty,Ce=t.unstable_scheduleCallback,we=t.unstable_cancelCallback,Te=t.unstable_shouldYield,Ee=t.unstable_requestPaint,De=t.unstable_now...
L9: `).replace(Ad,``)}function Md(e,t){return t=jd(t),jd(e)===t}function $(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Wt(e,r):(typeof ...
L10: https://github.com/highlightjs/highlight.js/issues/2277`),i=e,r=t),n===void 0&&(n=!0);let a={code:r,language:i};re(`before:highlight`,a);let o=a.result?a.result:v(a.language,a.code...
High
Child Process
Package source references child process execution.
dist-dashboard/assets/index-D6uFFy4M.jsView on unpkg · L8dist-mcp/mcp-server.jsView file
1239// validation function arguments
L1240: data: new codegen_1.Name("data"),
L1241: // data passed to validation function
...
L2266: id = normalizeId(id);
L2267: return resolver.resolve(baseId, id);
L2268: }
...
L3132: for (i = 0; i < input2.length; i++) {
L3133: code = input2[i].charCodeAt(0);
L3134: if (code === 48) {
...
L7649: function log(tag, msg) {
L7650: process.stderr.write(`${ts()} ${emojiFor(tag)} [${tag}] ${msg}
L7651: `);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist-mcp/mcp-server.jsView on unpkg · L12391239Trigger-reachable chain: manifest.main -> dist-mcp/mcp-server.js
L1239: // validation function arguments
L1240: data: new codegen_1.Name("data"),
L1241: // data passed to validation function
...
L2266: id = normalizeId(id);
L2267: return resolver.resolve(baseId, id);
L2268: }
...
L3132: for (i = 0; i < input2.length; i++) {
L3133: code = input2[i].charCodeAt(0);
L3134: if (code === 48) {
...
L7649: function log(tag, msg) {
L7650: process.stderr.write(`${ts()} ${emojiFor(tag)} [${tag}] ${msg}
L7651: `);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist-mcp/mcp-server.jsView on unpkg · L1239•matchType = previous_version_dangerous_delta
matchedPackage = gossipcat@0.6.12
matchedIdentity = npm:Z29zc2lwY2F0:0.6.12
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist-mcp/mcp-server.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist-mcp/mcp-server.js:
(0, import_fs5.writeFileSync)(path8, JSON.stringify(existing, null, 2));
(0, import_fs5.writeFileSync)(path8, JSON.stringify(existing, null, 2));
return `${provider} authentication failed (HTTP ${status}) for ${endpoint}: the API key was rejected. Verify the key for this provider/base_url \u2014 gossipcat resolves provider k...
function createProviderForAgent(agentId, provider, model, apiKey, baseUrl, projectRoot, keyRef) {
`no API key configured for agent "${agentId}" (provider ${provider}, base_url ${baseUrl ?? "default"}); run 'gossipcat key set "${keyName}"'`
return createProvider(provider, model, apiKey, pr
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist-mcp/mcp-server.jsView on unpkg54309} else {
L54310: process.stderr.write(
L54311: `[gossipcat code] Note: using --dangerously-load-development-channels (custom channels are not yet on Anthropic's allowlist). Set channel.allowlisted=true in .gossip/config.json on...
...
L54315: }
L54316: const child = (0, import_child_process17.spawn)("claude", claudeArgs, { stdio: "inherit" });
L54317: child.on("error", (err) => {
...
L54319: process.stderr.write(
L54320: `[gossipcat code] Error: "claude" is not on your PATH. Install Claude Code (https://claude.ai/download) and ensure the CLI is accessible.
L54321: `
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist-mcp/mcp-server.jsView on unpkg · L543091239Detached bundled service listener: dist-mcp/mcp-server.js launches a Node helper and exposes a broad-bound HTTP listener.
L1239: // validation function arguments
L1240: data: new codegen_1.Name("data"),
L1241: // data passed to validation function
...
L2266: id = normalizeId(id);
L2267: return resolver.resolve(baseId, id);
L2268: }
...
L3132: for (i = 0; i < input2.length; i++) {
L3133: code = input2[i].charCodeAt(0);
L3134: if (code === 48) {
...
L7649: function log(tag, msg) {
L7650: process.stderr.write(`${ts()} ${emojiFor(tag)} [${tag}] ${msg}
L7651: `);
High
Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
dist-mcp/mcp-server.jsView on unpkg · L12391239Trigger-reachable credential exfiltration chain: manifest.main -> dist-mcp/mcp-server.js
L1239: // validation function arguments
L1240: data: new codegen_1.Name("data"),
L1241: // data passed to validation function
...
L2266: id = normalizeId(id);
L2267: return resolver.resolve(baseId, id);
L2268: }
...
L3132: for (i = 0; i < input2.length; i++) {
L3133: code = input2[i].charCodeAt(0);
L3134: if (code === 48) {
...
L7649: function log(tag, msg) {
L7650: process.stderr.write(`${ts()} ${emojiFor(tag)} [${tag}] ${msg}
L7651: `);
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist-mcp/mcp-server.jsView on unpkg · L123954309Trigger-reachable command-output exfiltration chain: manifest.main -> dist-mcp/mcp-server.js
L54309: } else {
L54310: process.stderr.write(
L54311: `[gossipcat code] Note: using --dangerously-load-development-channels (custom channels are not yet on Anthropic's allowlist). Set channel.allowlisted=true in .gossip/config.json on...
...
L54315: }
L54316: const child = (0, import_child_process17.spawn)("claude", claudeArgs, { stdio: "inherit" });
L54317: child.on("error", (err) => {
...
L54319: process.stderr.write(
L54320: `[gossipcat code] Error: "claude" is not on your PATH. Install Claude Code (https://claude.ai/download) and ensure the CLI is accessible.
L54321: `
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist-mcp/mcp-server.jsView on unpkg · L54309•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist-mcp/mcp-server.jsView on unpkg2955sourceCode = this.opts.code.process(sourceCode, sch);
L2956: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2957: const validate2 = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist-mcp/mcp-server.jsView on unpkg · L29551239// validation function arguments
L1240: data: new codegen_1.Name("data"),
L1241: // data passed to validation function
...
L2266: id = normalizeId(id);
L2267: return resolver.resolve(baseId, id);
L2268: }
...
L3132: for (i = 0; i < input2.length; i++) {
L3133: code = input2[i].charCodeAt(0);
L3134: if (code === 48) {
...
L7649: function log(tag, msg) {
L7650: process.stderr.write(`${ts()} ${emojiFor(tag)} [${tag}] ${msg}
L7651: `);
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist-mcp/mcp-server.jsView on unpkg · L1239scripts/postinstall.jsView file
2/**
L3: * Generates .mcp.json with the correct absolute path to mcp-server.js
L4: * for the current install method (global npm, local project dep, git clone).
...
L8: const { join, resolve } = require('path');
L9: const { existsSync, readFileSync, writeFileSync, statSync } = require('fs');
L10:
...
L21:
L22: // For git clones: skip writing if .mcp.json already exists. Still warn if the
L23: // built server is older than package.json — stale-build warning is the most
...
L29: // build-recovery path at the end of this script instead.
L30: if (isGitClone && existsSync(join(packageRoot, '.mcp.json')) && existsSync(mcpServerPath)) {
L31: try {
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L210Cross-file remote execution chain: scripts/postinstall.js spawns dist-mcp/mcp-server.js; helper contains network access plus dynamic code execution.
L10:
L11: const scriptDir = __dirname; // .../gossipcat/scripts/
L12: const packageRoot = resolve(scriptDir, '..'); // .../gossipcat/
...
L15: // Detect install method:
L16: // global npm → process.env.npm[redacted] === 'true'
L17: // git clone → .git exists at packageRoot (development)
...
L22: // For git clones: skip writing if .mcp.json already exists. Still warn if the
L23: // built server is older than package.json — stale-build warning is the most
L24: // valuable signal on a developer re-running npm install after a pull.
...
L56: try {
L57: const pkg = JSON.parse(require('fs').readFileSync(pkgPath, 'utf8'));
L58: if (pk
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
scripts/postinstall.jsView on unpkg · L10•matchType = normalized_sha256
matchedPackage = gossipcat@0.6.11
matchedPath = scripts/postinstall.js
matchedIdentity = npm:Z29zc2lwY2F0:0.6.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.jsView on unpkgassets/hooks/discipline/pretool-signals-validate.shView file
•path = assets/hooks/discipline/pretool-signals-validate.sh
kind = build_helper
sizeBytes = 1857
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
assets/hooks/discipline/pretool-signals-validate.shView on unpkgFindings
4 Critical11 High5 Medium7 Low
CriticalCredential Exfiltrationdist-mcp/mcp-server.js
CriticalAi Agent Control Hijackscripts/postinstall.js
CriticalTrigger Reachable Dangerous Capabilitydist-mcp/mcp-server.js
CriticalPrevious Version Dangerous Deltadist-mcp/mcp-server.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist-dashboard/assets/index-D6uFFy4M.js
HighShell
HighCredential Redirect Persistencedist-mcp/mcp-server.js
HighCommand Output Exfiltrationdist-mcp/mcp-server.js
HighCross File Remote Execution Contextscripts/postinstall.js
HighSpawned Bundled Service Listenerdist-mcp/mcp-server.js
HighTrigger Reachable Credential Exfiltrationdist-mcp/mcp-server.js
HighTrigger Reachable Command Output Exfiltrationdist-mcp/mcp-server.js
HighSemantic Analysis Limiteddist-mcp/mcp-server.js
HighKnown Malware Source Similarityscripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperassets/hooks/discipline/pretool-signals-validate.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist-mcp/mcp-server.js
LowWeak Cryptodist-mcp/mcp-server.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gossipcat@0.8.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing gossipcat@0.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
7 known versions0.9.1latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 13, 2026, 12:06 PM0.9.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 13, 2026, 10:29 AM0.8.1shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 7, 2026, 3:04 PM0.6.12SuspiciousAgent extension lifecycle riskWarnPublishedJul 18, 2026, 11:49 PM0.6.11MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 11, 2026, 12:47 PM0.6.10MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 11, 2026, 12:15 PM0.6.9Suspicious—WarnUnder ReviewJul 4, 2026, 7:30 AM