Loading npm security reports…

gossipcat@0.8.1: AI-agent control-surface risk | LPM Firewall

registry / gossipcat / 0.8.1

gossipcat@0.8.1

Multi-agent orchestration for Claude Code — parallel review, consensus, adaptive dispatch

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically alters the consumer project's MCP configuration. This registers a package-controlled server for compatible AI-agent clients.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall.

Impact

A package installation changes a broad AI-agent control surface and can cause the bundled server to run in the consumer project.

Mechanism

Writes a gossipcat command into the consumer .mcp.json file.

Policy narrative

On npm install, package.json runs scripts/postinstall.js. For a local dependency, that script walks upward from node_modules to locate the consumer project and writes or merges its .mcp.json. The inserted entry starts dist-mcp/mcp-server.js with Node, registering the package as an MCP server without an explicit setup command. This is an unconsented install-time mutation of a consumer AI-agent control surface.

AI rationale

The automatic lifecycle hook modifies a consumer-owned MCP configuration rather than only package-owned files. That creates an unconsented agent-extension execution path.

Evidence

package.jsonscripts/postinstall.js.mcp.jsondist-mcp/mcp-server.js

Decision evidence

public snapshot

with false-positive risk.

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-dashboard/assets/index-D6uFFy4M.jsView file

8`+e.stack}}var Se=Object.prototype.hasOwnProperty,Ce=t.unstable_scheduleCallback,we=t.unstable_cancelCallback,Te=t.unstable_shouldYield,Ee=t.unstable_requestPaint,De=t.unstable_now... L9: `).replace(Ad,``)}function Md(e,t){return t=jd(t),jd(e)===t}function $(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Wt(e,r):(typeof ... L10: https://github.com/highlightjs/highlight.js/issues/2277`),i=e,r=t),n===void 0&&(n=!0);let a={code:r,language:i};re(`before:highlight`,a);let o=a.result?a.result:v(a.language,a.code...

High

Child Process

Package source references child process execution.

dist-dashboard/assets/index-D6uFFy4M.jsView on unpkg · L8

dist-mcp/mcp-server.jsView file

1239// validation function arguments L1240: data: new codegen_1.Name("data"), L1241: // data passed to validation function ... L2266: id = normalizeId(id); L2267: return resolver.resolve(baseId, id); L2268: } ... L3132: for (i = 0; i < input2.length; i++) { L3133: code = input2[i].charCodeAt(0); L3134: if (code === 48) { ... L7649: function log(tag, msg) { L7650: process.stderr.write(`${ts()} ${emojiFor(tag)} [${tag}] ${msg} L7651: `);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist-mcp/mcp-server.jsView on unpkg · L1239

1239Trigger-reachable chain: manifest.main -> dist-mcp/mcp-server.js L1239: // validation function arguments L1240: data: new codegen_1.Name("data"), L1241: // data passed to validation function ... L2266: id = normalizeId(id); L2267: return resolver.resolve(baseId, id); L2268: } ... L3132: for (i = 0; i < input2.length; i++) { L3133: code = input2[i].charCodeAt(0); L3134: if (code === 48) { ... L7649: function log(tag, msg) { L7650: process.stderr.write(`${ts()} ${emojiFor(tag)} [${tag}] ${msg} L7651: `);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist-mcp/mcp-server.jsView on unpkg · L1239

•matchType = previous_version_dangerous_delta matchedPackage = gossipcat@0.6.12 matchedIdentity = npm:Z29zc2lwY2F0:0.6.12 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

scripts/postinstall.jsView file

2/** L3: * Generates .mcp.json with the correct absolute path to mcp-server.js L4: * for the current install method (global npm, local project dep, git clone). ... L8: const { join, resolve } = require('path'); L9: const { existsSync, readFileSync, writeFileSync, statSync } = require('fs'); L10: ... L21: L22: // For git clones: skip writing if .mcp.json already exists. Still warn if the L23: // built server is older than package.json — stale-build warning is the most ... L29: // build-recovery path at the end of this script instead. L30: if (isGitClone && existsSync(join(packageRoot, '.mcp.json')) && existsSync(mcpServerPath)) { L31: try {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L2

10Cross-file remote execution chain: scripts/postinstall.js spawns dist-mcp/mcp-server.js; helper contains network access plus dynamic code execution. L10: L11: const scriptDir = __dirname; // .../gossipcat/scripts/ L12: const packageRoot = resolve(scriptDir, '..'); // .../gossipcat/ ... L15: // Detect install method: L16: // global npm → process.env.npm[redacted] === 'true' L17: // git clone → .git exists at packageRoot (development) ... L22: // For git clones: skip writing if .mcp.json already exists. Still warn if the L23: // built server is older than package.json — stale-build warning is the most L24: // valuable signal on a developer re-running npm install after a pull. ... L56: try { L57: const pkg = JSON.parse(require('fs').readFileSync(pkgPath, 'utf8')); L58: if (pk

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L10

assets/hooks/discipline/pretool-signals-validate.shView file

•path = assets/hooks/discipline/pretool-signals-validate.sh kind = build_helper sizeBytes = 1857 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/hooks/discipline/pretool-signals-validate.shView on unpkg

Source & flagged code

18 flagged

package.jsonView file

Lines 16-56json

16 "node": ">=22"

17 },

18 "workspaces": [

19 "packages/*",

20 "apps/*"

21 ],

22 "files": [

23 "dist-mcp/",

24 "dist-dashboard/",

25 "docs/HANDBOOK.md",

26 "docs/RULES.md",

27 "docs/CURSOR_RULES.md",

28 "scripts/postinstall.js",

29 "assets/hooks/discipline/**"

30 ],

31 "scripts": {

32 "build": "npm run build:all",

33 "build:all": "npm run build -w @gossip/types && npm run build -w @gossip/client && npm run build -w @gossip/tools && npm run build -w @gossip/orchestrator && npm run build -w @gossip/relay",

34 "test": "jest --config jest.config.base.js",

35 "clean": "rm -rf packages/*/dist apps/*/dist dist-mcp/ dist-dashboard/",

36 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "build:mcp": "rm -rf dist-mcp && npx esbuild apps/cli/src/mcp-server-sdk.ts --bundle --platform=node --target=node22 --outfile=dist-mcp/mcp-server.js --external:bufferutil --external:utf-8-validate --external:re2 --tsconfig=tsconfig.json && cp -r packages/orchestrator/src/default-skills dist-mcp/default-skills && cp -r packages/orchestrator/src/default-rules dist-mcp/default-rules && cp -r assets dist-mcp/assets && mkdir -p dist-mcp/data && cp data/archetypes.json dist-mcp/data/archetypes.json && chmod +x dist-mcp/mcp-server.js && chmod +x dist-mcp/assets/hooks/worktree-sandbox.sh && chmod ...

38 "build:dashboard": "cd packages/dashboard-v2 && npx vite build --outDir ../../dist-dashboard --emptyOutDir",

39 "prepublishOnly": "npm run build:all && npm run build:mcp && npm run build:dashboard",

40 "gossipcat": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

41 "start": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

42 "audit:memories": "node scripts/audit-memories.mjs"

43 },

44 "publishConfig": {

45 "access": "public"

46 },

47 "devDependencies": {

48 "@types/jest": "^29.5.11",

49 "@types/node": "^22.0.0",

50 "esbuild": "^0.28.1",

51 "jest": "^29.7.0",

52 "ts-jest": "^29.1.1",

53 "typescript": "^5.7.0"

54 },

55 "dependencies": {

56 "@clack/prompts": "^1.1.0",

Long lines were clipped for display.

dist-dashboard/assets/index-D6uFFy4M.jsView file

8`+e.stack}}var Se=Object.prototype.hasOwnProperty,Ce=t.unstable_scheduleCallback,we=t.unstable_cancelCallback,Te=t.unstable_shouldYield,Ee=t.unstable_requestPaint,De=t.unstable_now... L9: `).replace(Ad,``)}function Md(e,t){return t=jd(t),jd(e)===t}function $(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Wt(e,r):(typeof ... L10: https://github.com/highlightjs/highlight.js/issues/2277`),i=e,r=t),n===void 0&&(n=!0);let a={code:r,language:i};re(`before:highlight`,a);let o=a.result?a.result:v(a.language,a.code...

High

Child Process

Package source references child process execution.

dist-dashboard/assets/index-D6uFFy4M.jsView on unpkg · L8

dist-mcp/mcp-server.jsView file

1239// validation function arguments L1240: data: new codegen_1.Name("data"), L1241: // data passed to validation function ... L2266: id = normalizeId(id); L2267: return resolver.resolve(baseId, id); L2268: } ... L3132: for (i = 0; i < input2.length; i++) { L3133: code = input2[i].charCodeAt(0); L3134: if (code === 48) { ... L7649: function log(tag, msg) { L7650: process.stderr.write(`${ts()} ${emojiFor(tag)} [${tag}] ${msg} L7651: `);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist-mcp/mcp-server.jsView on unpkg · L1239

1239Trigger-reachable chain: manifest.main -> dist-mcp/mcp-server.js L1239: // validation function arguments L1240: data: new codegen_1.Name("data"), L1241: // data passed to validation function ... L2266: id = normalizeId(id); L2267: return resolver.resolve(baseId, id); L2268: } ... L3132: for (i = 0; i < input2.length; i++) { L3133: code = input2[i].charCodeAt(0); L3134: if (code === 48) { ... L7649: function log(tag, msg) { L7650: process.stderr.write(`${ts()} ${emojiFor(tag)} [${tag}] ${msg} L7651: `);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist-mcp/mcp-server.jsView on unpkg · L1239

•matchType = previous_version_dangerous_delta matchedPackage = gossipcat@0.6.12 matchedIdentity = npm:Z29zc2lwY2F0:0.6.12 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

scripts/postinstall.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * Generates .mcp.json with the correct absolute path to mcp-server.js

4 * for the current install method (global npm, local project dep, git clone).

5 *

6 * Never shipped in the package tarball — always regenerated per machine.

7 */

8const { join, resolve } = require

assets/hooks/discipline/pretool-signals-validate.shView file

•path = assets/hooks/discipline/pretool-signals-validate.sh kind = build_helper sizeBytes = 1857 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/hooks/discipline/pretool-signals-validate.shView on unpkg