registry / gossipcat / 0.6.10

gossipcat@0.6.10

Multi-agent orchestration for Claude Code — parallel review, consensus, adaptive dispatch

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The npm `postinstall` mutates a consuming project's broad MCP control configuration. It registers and enables the package's bundled executable as an MCP server without an explicit setup action.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of gossipcat@0.6.10

Impact

Unconsented activation of package-controlled code in an AI-agent/MCP control surface.

Mechanism

postinstall walks to the consumer root and writes/merges `.mcp.json` with a `gossipcat` server entry

Policy narrative

On installation, `scripts/postinstall.js` searches upward from the package directory for a workspace or project root, then creates or merges that project's `.mcp.json`. It injects a `gossipcat` MCP server configured to run the bundled `dist-mcp/mcp-server.js`. This is an unconsented install-time mutation of a foreign, broadly consumed AI-agent control file.

Rationale

Direct inspection confirms a concrete npm postinstall chain that modifies consumer-project MCP configuration and activates package code. Under the install-control-surface policy, this warrants blocking even without observed exfiltration.

Evidence

package.jsonscripts/postinstall.jsdist-mcp/mcp-server.js.mcp.json

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `node scripts/postinstall.js` automatically on install.
`scripts/postinstall.js` walks above `node_modules` to find the consumer workspace/project root.
The postinstall script creates or merges the consumer project's `.mcp.json`.
It inserts `mcpServers.gossipcat` that executes `node <package>/dist-mcp/mcp-server.js`.
This enables the package as an MCP server without an explicit user setup command.

Evidence against

The script preserves existing top-level fields and MCP server entries.
No install-time network request or credential collection was found in `scripts/postinstall.js`.
Bundled provider endpoints in `dist-mcp/mcp-server.js` support declared AI-provider functionality, not the install-time mutation.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 813 KB of source, external domains: github.com, raw.githubusercontent.com, react.dev, www.w3.org

Oversized source lightweight scan

dist-mcp/mcp-server.js3.17 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsEvalHighEntropyStringsUrlStringsraw.githubusercontent.com

Source & flagged code

7 flagged

package.jsonView file

Lines 16-56json

16 "node": ">=22"

17 },

18 "workspaces": [

19 "packages/*",

20 "apps/*"

21 ],

22 "files": [

23 "dist-mcp/",

24 "dist-dashboard/",

25 "docs/HANDBOOK.md",

26 "docs/RULES.md",

27 "docs/CURSOR_RULES.md",

28 "scripts/postinstall.js",

29 "assets/hooks/discipline/**"

30 ],

31 "scripts": {

32 "build": "npm run build:all",

33 "build:all": "npm run build -w @gossip/types && npm run build -w @gossip/client && npm run build -w @gossip/tools && npm run build -w @gossip/orchestrator && npm run build -w @gossip/relay",

34 "test": "jest --config jest.config.base.js",

35 "clean": "rm -rf packages/*/dist apps/*/dist dist-mcp/ dist-dashboard/",

36 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "build:mcp": "rm -rf dist-mcp && npx esbuild apps/cli/src/mcp-server-sdk.ts --bundle --platform=node --target=node22 --outfile=dist-mcp/mcp-server.js --external:bufferutil --external:utf-8-validate --external:re2 --tsconfig=tsconfig.json && cp -r packages/orchestrator/src/default-skills dist-mcp/default-skills && cp -r packages/orchestrator/src/default-rules dist-mcp/default-rules && cp -r assets dist-mcp/assets && mkdir -p dist-mcp/data && cp data/archetypes.json dist-mcp/data/archetypes.json && chmod +x dist-mcp/mcp-server.js && chmod +x dist-mcp/assets/hooks/worktree-sandbox.sh && chmod ...

38 "build:dashboard": "cd packages/dashboard-v2 && npx vite build --outDir ../../dist-dashboard --emptyOutDir",

39 "prepublishOnly": "npm run build:all && npm run build:mcp && npm run build:dashboard",

40 "gossipcat": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

41 "start": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

42 "audit:memories": "node scripts/audit-memories.mjs"

43 },

44 "publishConfig": {

45 "access": "public"

46 },

47 "devDependencies": {

48 "@types/jest": "^29.5.11",

49 "@types/node": "^22.0.0",

50 "esbuild": "^0.28.1",

51 "jest": "^29.7.0",

52 "ts-jest": "^29.1.1",

53 "typescript": "^5.7.0"

54 },

55 "dependencies": {

56 "@clack/prompts": "^1.1.0",

Long lines were clipped for display.

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2/**

3 * Generates .mcp.json with the correct absolute path to mcp-server.js

4 * for the current install method (global npm, local project dep, git clone).

5 *

6 * Never shipped in the package tarball — always regenerated per machine.

7 */

8const { join, resolve } = require('path');

9const {

assets/hooks/discipline/pretool-signals-validate.shView file

•path = assets/hooks/discipline/pretool-signals-validate.sh kind = build_helper sizeBytes = 1857 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/hooks/discipline/pretool-signals-validate.shView on unpkg

dist-dashboard/assets/Geist-Variable-jflMhO5d.woff2View file

•path = dist-dashboard/assets/Geist-Variable-jflMhO5d.woff2 kind = high_entropy_blob sizeBytes = 69740 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-dashboard/assets/Geist-Variable-jflMhO5d.woff2View on unpkg

dist-mcp/mcp-server.jsView file

•path = dist-mcp/mcp-server.js kind = oversized_source_file sizeBytes = 3322076 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-mcp/mcp-server.jsView on unpkg

•path = dist-mcp/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 3322076 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-mcp/mcp-server.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L2: /** L3: * Generates .mcp.json with the correct absolute path to mcp-server.js L4: * for the current install method (global npm, local project dep, git clone). ... L8: const { join, resolve } = require('path'); L9: const { existsSync, readFileSync, writeFileSync, statSync } = require('fs'); L10: ... L21: L22: // For git clones: skip writing if .mcp.json already exists. Still warn if the L23: // built server is older than package.json — stale-build warning is the most ... L29: // build-recovery path at the end of this script instead. L30: if (isGitClone && existsSync(join(packageRoot, '.mcp.json')) && existsSync(mcpServerPath)) { L31: try { Payload evidence from dist-mcp/default-rules/gossipcat-rules.md: L1: # Gossipcat — Multi-Agent Orchestration L2:

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L1

assets/hooks/discipline/pretool-signals-validate.shView file

•path = assets/hooks/discipline/pretool-signals-validate.sh kind = build_helper sizeBytes = 1857 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/hooks/discipline/pretool-signals-validate.shView on unpkg

dist-dashboard/assets/Geist-Variable-jflMhO5d.woff2View file

•path = dist-dashboard/assets/Geist-Variable-jflMhO5d.woff2 kind = high_entropy_blob sizeBytes = 69740 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-dashboard/assets/Geist-Variable-jflMhO5d.woff2View on unpkg

dist-mcp/mcp-server.jsView file

•path = dist-mcp/mcp-server.js kind = oversized_source_file sizeBytes = 3322076 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-mcp/mcp-server.jsView on unpkg

•path = dist-mcp/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 3322076 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-mcp/mcp-server.jsView on unpkg

Findings

1 Critical3 High6 Medium7 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobdist-dashboard/assets/Geist-Variable-jflMhO5d.woff2

HighOversized Source Filedist-mcp/mcp-server.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperassets/hooks/discipline/pretool-signals-validate.sh

MediumOversized Cli Entrypointdist-mcp/mcp-server.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 16-56json

16 "node": ">=22"

17 },

18 "workspaces": [

19 "packages/*",

20 "apps/*"

21 ],

22 "files": [

23 "dist-mcp/",

24 "dist-dashboard/",

25 "docs/HANDBOOK.md",

26 "docs/RULES.md",

27 "docs/CURSOR_RULES.md",

28 "scripts/postinstall.js",

29 "assets/hooks/discipline/**"

30 ],

31 "scripts": {

32 "build": "npm run build:all",

33 "build:all": "npm run build -w @gossip/types && npm run build -w @gossip/client && npm run build -w @gossip/tools && npm run build -w @gossip/orchestrator && npm run build -w @gossip/relay",

34 "test": "jest --config jest.config.base.js",

35 "clean": "rm -rf packages/*/dist apps/*/dist dist-mcp/ dist-dashboard/",

36 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

38 "build:dashboard": "cd packages/dashboard-v2 && npx vite build --outDir ../../dist-dashboard --emptyOutDir",

39 "prepublishOnly": "npm run build:all && npm run build:mcp && npm run build:dashboard",

40 "gossipcat": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

41 "start": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

42 "audit:memories": "node scripts/audit-memories.mjs"

43 },

44 "publishConfig": {

45 "access": "public"

46 },

47 "devDependencies": {

48 "@types/jest": "^29.5.11",

49 "@types/node": "^22.0.0",

50 "esbuild": "^0.28.1",

51 "jest": "^29.7.0",

52 "ts-jest": "^29.1.1",

53 "typescript": "^5.7.0"

54 },

55 "dependencies": {

56 "@clack/prompts": "^1.1.0",

Long lines were clipped for display.

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2/**

3 * Generates .mcp.json with the correct absolute path to mcp-server.js

4 * for the current install method (global npm, local project dep, git clone).

5 *

6 * Never shipped in the package tarball — always regenerated per machine.

7 */

8const { join, resolve } = require('path');

9const {

assets/hooks/discipline/pretool-signals-validate.shView file

•path = assets/hooks/discipline/pretool-signals-validate.sh kind = build_helper sizeBytes = 1857 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/hooks/discipline/pretool-signals-validate.shView on unpkg

dist-dashboard/assets/Geist-Variable-jflMhO5d.woff2View file

•path = dist-dashboard/assets/Geist-Variable-jflMhO5d.woff2 kind = high_entropy_blob sizeBytes = 69740 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-dashboard/assets/Geist-Variable-jflMhO5d.woff2View on unpkg

dist-mcp/mcp-server.jsView file

•path = dist-mcp/mcp-server.js kind = oversized_source_file sizeBytes = 3322076 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-mcp/mcp-server.jsView on unpkg

•path = dist-mcp/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 3322076 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-mcp/mcp-server.jsView on unpkg