gossipcat@0.9.1

Multi-agent orchestration for Claude Code — parallel review, consensus, adaptive dispatch

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The postinstall hook performs automatic first-party MCP configuration in the consumer project, which warrants a warning under the agent integration policy. The inspected runtime hint is a constrained local file read, and the reviewed evidence does not establish a concrete malicious attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A local npm installation runs the package's postinstall hook.

Impact

The package's MCP server is configured for the consumer project without a separate setup action.

Mechanism

The hook locates the consumer project root, merges its existing MCP configuration, adds a gossipcat entry that launches the bundled server, and writes .mcp.json.

AI rationale

Evidence

package.jsonscripts/postinstall.js.mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs scripts/postinstall.js during installation.
For local installs, the hook selects the consumer project root for its .mcp.json file.
The hook preserves existing MCP entries, adds gossipcat's own server command, and writes the configuration.
The flagged runtime location reads an existing Claude skill from a cache after checking that its resolved path stays within that cache; it is used while building a skill-generation prompt.

Evidence against

The install hook registers only gossipcat's own MCP server and preserves existing entries.
The indicated Claude plugin-cache code reads a local skill file; it does not establish a separate agent configuration mutation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

18 flagged

package.jsonView file

Lines 17-57json

17 },

18 "workspaces": [

19 "packages/*",

20 "apps/*"

21 ],

22 "files": [

23 "dist-mcp/",

24 "dist-dashboard/",

25 "docs/HANDBOOK.md",

26 "docs/RULES.md",

27 "docs/CURSOR_RULES.md",

28 "scripts/postinstall.js",

29 "scripts/codex-bridge-service.py",

30 "assets/hooks/discipline/**"

31 ],

32 "scripts": {

33 "build": "npm run build:all",

34 "build:all": "npm run build -w @gossip/types && npm run build -w @gossip/client && npm run build -w @gossip/tools && npm run build -w @gossip/orchestrator && npm run build -w @gossip/relay",

35 "test": "jest --config jest.config.base.js",

36 "clean": "rm -rf packages/*/dist apps/*/dist dist-mcp/ dist-dashboard/",

37 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "build:mcp": "rm -rf dist-mcp && npx esbuild apps/cli/src/mcp-server-sdk.ts --bundle --platform=node --target=node22 --outfile=dist-mcp/mcp-server.js --external:bufferutil --external:utf-8-validate --external:re2 --tsconfig=tsconfig.json && cp -r packages/orchestrator/src/default-skills dist-mcp/default-skills && cp -r packages/orchestrator/src/default-rules dist-mcp/default-rules && cp -r assets dist-mcp/assets && mkdir -p dist-mcp/data && cp data/archetypes.json dist-mcp/data/archetypes.json && chmod +x dist-mcp/mcp-server.js && chmod +x dist-mcp/assets/hooks/worktree-sandbox.sh && chmod ...

39 "build:dashboard": "cd packages/dashboard-v2 && npx vite build --outDir ../../dist-dashboard --emptyOutDir",

40 "prepublishOnly": "npm run build:all && npm run build:mcp && npm run build:dashboard",

41 "gossipcat": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

42 "start": "npx ts-node -r tsconfig-paths/register -P tsconfig.json apps/cli/src/index.ts",

43 "audit:memories": "node scripts/audit-memories.mjs",

44 "build:codex-bridge": "esbuild apps/cli/src/codex-bridge-server.ts --bundle --platform=node --target=node22 --outfile=dist-mcp/codex-bridge-server.js --tsconfig=tsconfig.json --external:re2 --external:bufferutil --external:utf-8-validate",

45 "codex:bridge": "node dist-mcp/codex-bridge-server.js ."

46 },

47 "publishConfig": {

48 "access": "public"

49 },

50 "devDependencies": {

51 "@types/jest": "^29.5.11",

52 "@types/node": "^22.0.0",

53 "esbuild": "^0.28.1",

54 "jest": "^29.7.0",

55 "ts-jest": "^29.1.1",

56 "typescript": "^5.7.0"

57 },

Long lines were clipped for display.

scripts/postinstall.jsView file

Lines 126-160javascript

126 // Soft-fail on write errors: global npm installs often target root-owned dirs

127 // where EACCES is expected. Hard-exiting here would abort `npm install -g`

128 // for every user without sudo — users can run `gossipcat key set` after.

129 // Regression guard: tests/cli/install-packaging.test.ts:133-140.

130 console.warn(`gossipcat: postinstall could not write .mcp.json (${e.code || e

dist-mcp/mcp-server.jsView file

64if (st.size > maxBytes) return "oversized"; L65: return { value: JSON.parse((0, import_fs.readFileSync)(path8, "utf-8")) }; L66: } catch { ... L750: } L751: function findProjectRoot(start = process.cwd()) { L752: let dir = (0, import_path4.resolve)(start); ... L765: } L766: function isChannelModeConfirmed(env2 = process.env) { L767: return env2["GOSSIPCAT_CHANNEL_ACTIVE"] === "1" || Boolean(env2["CLAUDE_CHANNEL_ID"]); ... L2077: // validation function arguments L2078: data: new codegen_1.Name("data"), L2079: // data passed to validation function

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist-mcp/mcp-server.jsView on unpkg · L64

64Trigger-reachable chain: manifest.main -> dist-mcp/mcp-server.js L64: if (st.size > maxBytes) return "oversized"; L65: return { value: JSON.parse((0, import_fs.readFileSync)(path8, "utf-8")) }; L66: } catch { ... L750: } L751: function findProjectRoot(start = process.cwd()) { L752: let dir = (0, import_path4.resolve)(start); ... L765: } L766: function isChannelModeConfirmed(env2 = process.env) { L767: return env2["GOSSIPCAT_CHANNEL_ACTIVE"] === "1" || Boolean(env2["CLAUDE_CHANNEL_ID"]); ... L2077: // validation function arguments L2078: data: new codegen_1.Name("data"), L2079: // data passed to validation function

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist-mcp/mcp-server.jsView on unpkg · L64

•matchType = previous_version_dangerous_delta matchedPackage = gossipcat@0.9.0 matchedIdentity = npm:Z29zc2lwY2F0:0.9.0 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

dist-mcp/codex-bridge-server.jsView file

5862"use strict"; L5863: import_http = require("http"); L5864: import_fs = require("fs"); ... L5870: // packages/orchestrator/src/codex-worker.ts L5871: function codexChildEnv(source2 = process.env) { L5872: const env = {}; ... L5877: } L5878: var import_fs2, import_os, import_path2, import_child_process2, CODEX_ENV_KEYS, CodexWorker; L5879: var init_codex_worker = __esm({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-mcp/codex-bridge-server.jsView on unpkg · L5862

60kStatusCode: /* @__PURE__ */ Symbol("status-code"), L61: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L62: NOOP: () => { ... L113: } else { L114: buf = Buffer.from(data); L115: toBuffer.readOnly = false; ... L125: }; L126: if (!process.env.WS_NO_BUFFER_UTIL) { L127: try { ... L177: * L178: * @private L179: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist-mcp/codex-bridge-server.jsView on unpkg · L60

scripts/codex-bridge-service.pyView file

•path = scripts/codex-bridge-service.py kind = build_helper sizeBytes = 3458 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/codex-bridge-service.pyView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

2/** L3: * Generates .mcp.json with the correct absolute path to mcp-server.js L4: * for the current install method (global npm, local project dep, git clone). ... L8: const { join, resolve } = require('path'); L9: const { existsSync, readFileSync, writeFileSync, statSync } = require('fs'); L10: ... L21: L22: // For git clones: skip writing if .mcp.json already exists. Still warn if the L23: // built server is older than package.json — stale-build warning is the most ... L29: // build-recovery path at the end of this script instead. L30: if (isGitClone && existsSync(join(packageRoot, '.mcp.json')) && existsSync(mcpServerPath)) { L31: try {

Findings

4 Critical11 High5 Medium7 Low

CriticalCredential Exfiltrationdist-mcp/mcp-server.js

CriticalAi Agent Control Hijackscripts/postinstall.js

CriticalTrigger Reachable Dangerous Capabilitydist-mcp/mcp-server.js

CriticalPrevious Version Dangerous Deltadist-mcp/mcp-server.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall.js

HighShell

HighSame File Env Network Executiondist-mcp/codex-bridge-server.js

HighCredential Redirect Persistencedist-mcp/mcp-server.js

HighCommand Output Exfiltrationdist-mcp/mcp-server.js

HighCross File Remote Execution Contextscripts/postinstall.js

Affected versions and remediation

This report applies to gossipcat@0.9.1.

See all versions of gossipcat for other recorded verdicts.

Review the evidence and your use of gossipcat@0.9.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 12:11:03.831Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.