registry / Remote code execution / integram-mcp
integram-mcp
MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol
This report shows the evidence for integram-mcp@0.7.160. 1 of 69 known versions is blocked or flagged. The newest version, 0.7.169, is flagged. See all versions.
AI Security Review
scanned 7h ago · by lpm-firewall-aiThe package has no install hook, but its executable performs automatic remote code updates in Git checkouts and restarts into the changed code. This is a concrete remote code execution path, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the package executable starts the update check and schedules hourly checks.
Impact
Code delivered through the configured Git remote can be installed and executed without a separate update command.
Mechanism
The updater pulls the current branch with git pull --ff-only, runs npm install after a revision change, then schedules process exit so the updated code can run.
Attack narrative
Starting the executable activates an automatic Git updater. If the package is run from a Git checkout and its configured remote advances, the process pulls the change, runs npm install, and restarts. This allows remote changes to become executable without a separate update command. Registry installs without Git metadata skip this path, but that limitation does not guard Git checkout users.
AI rationale
The package has no install hook, but its executable performs automatic remote code updates in Git checkouts and restarts into the changed code. This is a concrete remote code execution path, so the package should be blocked.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Malicious at 86.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes index.js as its executable and has no install lifecycle hook.
- When the executable starts, it checks for updates immediately and repeats the check hourly.
- In a Git checkout, the updater runs git pull --ff-only and, when the revision changes, runs npm install and schedules a restart, allowing remotely changed code to run automatically.
Evidence against
- The updater depends on the package directory being a Git worktree; ordinary registry installs without Git metadata skip it.
- The manifest’s prepublishOnly script only runs a version check.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourceindex.jsView file
2380L2381: import { execSync } from 'child_process';
L2382: import { realpathSync } from 'fs';
High
2408log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`);
L2409: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {}
L2410: // Allow pending responses to drain before exit
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
index.jsView on unpkg · L2408package.jsonView file
19"bin": {
"integram-mcp": "./index.js"
},
"scripts": {
"test": "node scripts/check-versions.mjs",
"prepublishOnly": "node scripts/check-versions.mjs"
}
High
Suspicious Lifecycle Evidence
The package exposes index.js as its executable and has no install lifecycle hook.
package.jsonFindings
4 High3 Medium5 Low
HighChild Processindex.js
HighShell
HighRuntime Package Installindex.js
HighSuspicious Lifecycle Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to integram-mcp@0.7.160.
The versions list below shows the verdict for each recorded version.
- Avoid installing integram-mcp@0.7.160. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.