gossipcat@0.9.0

Multi-agent orchestration for Claude Code — parallel review, consensus, adaptive dispatch

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The automatic postinstall registration is a guarded-policy warning for first-party agent integration, not evidence of a malicious attack. The scanner’s flagged runtime location is a local skill-template lookup and does not support its credential-exfiltration claim.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm runs its postinstall hook.

Impact

An MCP host using that configuration can launch gossipcat after installation.

Mechanism

The hook finds a consumer workspace root, merges its existing MCP configuration, adds a gossipcat server entry, and writes the file.

AI rationale

Evidence

scripts/postinstall.js.mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs scripts/postinstall.js automatically after installation.
For local installs, the hook searches parent directories and selects a workspace root, then targets that root’s .mcp.json.
The hook adds a gossipcat MCP server entry that launches the package’s bundled server and writes the merged configuration.
The flagged runtime location is a template loader: its caller uses the template during skill generation, and the loader reads an existing local Claude plugin skill after checking that its resolved path stays inside the cache.

Evidence against

The postinstall hook preserves existing MCP server entries and adds only gossipcat’s own server entry.
The flagged runtime location reads a local template; it does not show credential collection or network transfer.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

18 flagged

package.jsonView file

Lines 16-56json

16 "node": ">=22"

17 },

18 "workspaces": [

19 "packages/*",

20 "apps/*"

21 ],

22 "files": [

23 "dist-mcp/",

24 "dist-dashboard/",

25 "docs/HANDBOOK.md",

26 "docs/RULES.md",

27 "docs/CURSOR_RULES.md",

28 "scripts/postinstall.js",

29 "assets/hooks/discipline/**"

30 ],

31 "scripts": {

32 "build": "npm run build:all",

33 "build:all": "npm run build -w @gossip/types && npm run build -w @gossip/client && npm run build -w @gossip/tools && npm run build -w @gossip/orchestrator && npm run build -w @gossip/relay",

34 "test": "jest --config jest.config.base.js",

35 "clean": "rm -rf packages/*/dist apps/*/dist dist-mcp/ dist-dashboard/",

36 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "build:mcp": "rm -rf dist-mcp && npx esbuild apps/cli/src/mcp-server-sdk.ts --bundle --platform=node --target=node22 --outfile=dist-mcp/mcp-server.js --external:bufferutil --external:utf-8-validate --external:re2 --tsconfig=tsconfig.json && cp -r packages/orchestrator/src/default-skills dist-mcp/default-skills && cp -r packages/orchestrator/src/default-rules dist-mcp/default-rules && cp -r assets dist-mcp/assets && mkdir -p dist-mcp/data && cp data/archetypes.json dist-mcp/data/archetypes.json && chmod +x dist-mcp/mcp-server.js && chmod +x dist-mcp/assets/hooks/worktree-sandbox.sh && chmod ...

38 "build:dashboard": "cd packages/dashboard-v2 && npx vite build --outDir ../../dist-dashboard --emptyOutDir",

39 "prepublishOnly": "npm run build:all && npm run build:mcp && npm run build:dashboard",

40 "gossipcat": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

41 "start": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

42 "audit:memories": "node scripts/audit-memories.mjs",

43 "build:codex-bridge": "esbuild apps/cli/src/codex-bridge-server.ts --bundle --platform=node --target=node22 --outfile=dist-mcp/codex-bridge-server.js --tsconfig=tsconfig.json --external:re2 --external:bufferutil --external:utf-8-validate",

44 "codex:bridge": "node dist-mcp/codex-bridge-server.js ."

45 },

46 "publishConfig": {

47 "access": "public"

48 },

49 "devDependencies": {

50 "@types/jest": "^29.5.11",

51 "@types/node": "^22.0.0",

52 "esbuild": "^0.28.1",

53 "jest": "^29.7.0",

54 "ts-jest": "^29.1.1",

55 "typescript": "^5.7.0"

56 },

Long lines were clipped for display.

scripts/postinstall.jsView file

Lines 126-160javascript

126 // Soft-fail on write errors: global npm installs often target root-owned dirs

127 // where EACCES is expected. Hard-exiting here would abort `npm install -g`

128 // for every user without sudo — users can run `gossipcat key set` after.

129 // Regression guard: tests/cli/install-packaging.test.ts:133-140.

130 console.warn(`gossipcat: postinstall could not write .mcp.json (${e.code || e

dist-mcp/mcp-server.jsView file

64if (st.size > maxBytes) return "oversized"; L65: return { value: JSON.parse((0, import_fs.readFileSync)(path8, "utf-8")) }; L66: } catch { ... L563: } L564: function findProjectRoot(start = process.cwd()) { L565: let dir = (0, import_path3.resolve)(start); ... L578: } L579: function isChannelModeConfirmed(env2 = process.env) { L580: return env2["GOSSIPCAT_CHANNEL_ACTIVE"] === "1" || Boolean(env2["CLAUDE_CHANNEL_ID"]); ... L1851: // validation function arguments L1852: data: new codegen_1.Name("data"), L1853: // data passed to validation function

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist-mcp/mcp-server.jsView on unpkg · L64

64Trigger-reachable chain: manifest.main -> dist-mcp/mcp-server.js L64: if (st.size > maxBytes) return "oversized"; L65: return { value: JSON.parse((0, import_fs.readFileSync)(path8, "utf-8")) }; L66: } catch { ... L563: } L564: function findProjectRoot(start = process.cwd()) { L565: let dir = (0, import_path3.resolve)(start); ... L578: } L579: function isChannelModeConfirmed(env2 = process.env) { L580: return env2["GOSSIPCAT_CHANNEL_ACTIVE"] === "1" || Boolean(env2["CLAUDE_CHANNEL_ID"]); ... L1851: // validation function arguments L1852: data: new codegen_1.Name("data"), L1853: // data passed to validation function

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist-mcp/mcp-server.jsView on unpkg · L64

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist-mcp/mcp-server.js: (0, import_fs.writeFileSync)(tmp, data, { encoding: "utf-8", mode: 384, flag: "wx" }); (0, import_fs2.writeFileSync)((0, import_path2.join)(this.dir, `${id}.${marker}`), JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), via }), { (0, import_fs8.writeFileSync)(path8, JSON.stringify(existing, null, 2)); (0, import_fs8.writeFileSync)(path8, JSON.stringify(existing, null, 2)); return `${provider} authentication failed (HTTP ${status}) for ${endpoint}: the API key was rejected. Verify the key for this provider/base_url \u2014 gossipcat resolves provider k... function createProviderForAgent(agentId, pro

dist-mcp/codex-bridge-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gossipcat@0.6.12 matchedIdentity = npm:Z29zc2lwY2F0:0.6.12 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-mcp/codex-bridge-server.jsView on unpkg

5862"use strict"; L5863: import_http = require("http"); L5864: import_fs = require("fs"); ... L5870: // packages/orchestrator/src/codex-worker.ts L5871: function codexChildEnv(source2 = process.env) { L5872: const env = {}; ... L5877: } L5878: var import_fs2, import_os, import_path2, import_child_process2, CODEX_ENV_KEYS, CodexWorker; L5879: var init_codex_worker = __esm({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-mcp/codex-bridge-server.jsView on unpkg · L5862

60kStatusCode: /* @__PURE__ */ Symbol("status-code"), L61: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L62: NOOP: () => { ... L113: } else { L114: buf = Buffer.from(data); L115: toBuffer.readOnly = false; ... L125: }; L126: if (!process.env.WS_NO_BUFFER_UTIL) { L127: try { ... L177: * L178: * @private L179: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

assets/hooks/discipline/pretool-signals-validate.shView file

•path = assets/hooks/discipline/pretool-signals-validate.sh kind = build_helper sizeBytes = 1857 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/hooks/discipline/pretool-signals-validate.shView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

2/** L3: * Generates .mcp.json with the correct absolute path to mcp-server.js L4: * for the current install method (global npm, local project dep, git clone). ... L8: const { join, resolve } = require('path'); L9: const { existsSync, readFileSync, writeFileSync, statSync } = require('fs'); L10: ... L21: L22: // For git clones: skip writing if .mcp.json already exists. Still warn if the L23: // built server is older than package.json — stale-build warning is the most ... L29: // build-recovery path at the end of this script instead. L30: if (isGitClone && existsSync(join(packageRoot, '.mcp.json')) && existsSync(mcpServerPath)) { L31: try {

Findings

4 Critical11 High5 Medium7 Low

CriticalCredential Exfiltrationdist-mcp/mcp-server.js

CriticalAi Agent Control Hijackscripts/postinstall.js

CriticalTrigger Reachable Dangerous Capabilitydist-mcp/mcp-server.js

CriticalPrevious Version Dangerous Deltadist-mcp/codex-bridge-server.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall.js

HighShell

HighSame File Env Network Executiondist-mcp/codex-bridge-server.js

HighCredential Redirect Persistencedist-mcp/mcp-server.js

HighCommand Output Exfiltrationdist-mcp/mcp-server.js

HighCross File Remote Execution Contextscripts/postinstall.js

Affected versions and remediation

This report applies to gossipcat@0.9.0.

See all versions of gossipcat for other recorded verdicts.

Review the evidence and your use of gossipcat@0.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 10:32:06.541Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.