registry / Remote code execution / integram-mcp / 0.7.104

integram-mcp@0.7.104

MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The active automatic Git pull followed by dependency installation is a concrete remote code update capability. It is not an npm lifecycle attack and is guarded by the presence of a Git checkout, so blocking as malware is not supported.

Static reason

One or more suspicious static signals were detected.

Trigger

Executing the integram-mcp command from a Git repository.

Impact

A remote repository update or dependency lifecycle could cause code to run in the user's environment.

Mechanism

The program runs Git pull and then npm install after detecting a changed revision.

AI rationale

Evidence

index.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package exposes index.js as its command and has no npm install lifecycle hook.
When run from a Git checkout, the command pulls its configured remote and installs dependencies after a changed revision.
The update routine runs through main only when index.js is executed as the program.

Evidence against

The automatic update is limited to a directory that Git identifies as a repository; no fixed external host or credential export was found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 270 KB of source, external domains: api.example.com, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

index.jsView file

Lines 3082-3138javascript

3082 rememberActivation();

3083 workspace = slug;

3084

3085 // Загрузить инструменты целевого воркспейса: ядро + восстановленная

3086 // из памяти активация (инцидент 05.09.2026 — см. блок у activationMemory).

3087 const { tools, restored } = await loadWorkspaceTools(slug);

3088

3089 log(`Switched to workspace "${slug}", ${activeTools.size} tools loaded (${restored} restored from memory)`);

3090

3091 return {

3092 content: [{ type: 'text', text: `Switched to workspace "${slug}". Loaded ${tools.length} tools (${activeTools.size} active${restored ? `, ${restored} restored from previous activation` : ', core only'}). Use search_tools to activate more.` }],

3093 };

3094 } catch (err) {

3095 return { content: [{ type: 'text', text: `Error switching workspace: ${err.message}` }], isError: true };

3096 }

3097}

3098

3099// ─── Bootstrap ───────────────────────────────────────────────────────────────

3100

3101// ─── Auto-update from git ────────────────────────────────────────────────────

3102

3103import { execSync } from 'child_process';

3104import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3102

3105import { dirname } from 'path';

3106import { fileURLToPath } from 'url';

3107

3108const __dirname = dirname(fileURLToPath(import.meta.url));

3109const AUTO_UPDATE_INTERVAL = 60 * 60 * 1000; // check every hour

3110

3111function tryAutoUpdate() {

3112 try {

3113 execSync('git rev-parse --git-dir', { cwd: __dirname, stdio: 'ignore' });

3114 const before = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

3115 execSync('git pull --ff-only', { cwd: __dirname, stdio: 'ignore', timeout: 15000 });

3116 const after = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

3117 if (before !== after) {

3118 log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`);

3119 try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {}

3120 // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3118

3121 log('Shutting down gracefully...');

3122 setTimeout(() => process.exit(0), 2000);

3123 }

3124 } catch { /* not a git repo or offline — skip */ }

3125}

3126

3127async function main() {

3128 tryAutoUpdate();

3129 setInterval(tryAutoUpdate, AUTO_UPDATE_INTERVAL);

3130

3131 // Не ждём: запуск сервера не должен зависеть от доступности реестра npm.

3132 checkForUpdate();

3133 setInterval(checkForUpdate, UPDATE_CHECK_INTERVAL_MS).unref();

3134

3135 log(`integram-mcp ${PKG.version}`);

3136 log(`Connecting to ${BASE_URL}, workspace "${workspace || '(not set)'}"`);

3137

3138 // 1. Login

package.jsonView file

Lines 1-39json

2 "name": "integram-mcp",

3 "version": "0.7.104",

4 "type": "module",

5 "description": "MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol",

Source & flagged code

3 flagged · loading source

index.jsView file

3102L3103: import { execSync } from 'child_process'; L3104: import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3102

3118log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L3119: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L3120: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3118

package.jsonView file

19"bin": { "integram-mcp": "./index.js" }, "scripts": { "test": "node scripts/check-versions.mjs", "prepublishOnly": "node scripts/check-versions.mjs" }, "files": [ "

Medium

Suspicious Lifecycle Evidence

The package exposes index.js as its command and has no npm install lifecycle hook.

Findings

3 High4 Medium5 Low

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to integram-mcp@0.7.104.

See all versions of integram-mcp for other recorded verdicts.

Review the evidence and your use of integram-mcp@0.7.104 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 09:52:12.805Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.