registry / Remote code execution / integram-mcp / 0.7.146

integram-mcp@0.7.146

MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The runtime updater can pull changes from an enclosing checkout’s configured remote without a separate confirmation, creating a real but conditional code-update risk. The source does not establish a package-controlled remote or an install-time trigger, so this supports a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the package command, followed by hourly checks.

Impact

An unattended pull can change files in the enclosing checkout and expose the running service to code from that remote.

Mechanism

The updater runs Git from the package directory; Git may act on an enclosing checkout and pull from its configured remote.

AI rationale

Evidence

index.js

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes index.js as its command and has no automatic install hook; prepublishOnly is the only lifecycle script shown.
When the command starts, it runs the updater and schedules it hourly.
The updater runs git pull from the package directory and, after a change, runs npm install and restarts the process.
The cited runtime locations concern update checks and startup; they show no account action or account-action caller.

Evidence against

The updater runs only when the command is launched, not as an npm install hook.
The Git remote is configured outside the inspected code, so the source does not establish a package-controlled update destination.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 212 KB of source, external domains: registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

index.jsView file

Lines 2331-2399javascript

2331

2332 // Загрузить инструменты целевого воркспейса: ядро + восстановленная

2333 // из памяти активация (инцидент 05.09.2026 — см. блок у activationMemory).

2334 const { tools, restored } = await loadWorkspaceTools(slug);

2335

2336 log(`Switched to workspace "${slug}", ${activeTools.size} tools loaded (${restored} restored from memory)`);

2337 memoryBriefingWs = null;

2338 checkMemoryBriefing();

2339

2340 return {

2341 content: [{ type: 'text', text: `Switched to workspace "${slug}". Loaded ${tools.length} tools (${activeTools.size} active${restored ? `, ${restored} restored from previous activation` : ', core only'}). Use search_tools to activate more.` }],

2342 };

2343 } catch (err) {

2344 return { content: [{ type: 'text', text: `Error switching workspace: ${err.message}` }], isError: true };

2345 }

2346}

2347

2348// ─── Bootstrap ───────────────────────────────────────────────────────────────

2349

2350// ─── Auto-update from git ────────────────────────────────────────────────────

2351

2352import { execSync } from 'child_process';

2353import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2351

2354import { dirname } from 'path';

2355import { fileURLToPath } from 'url';

2356

2357const __dirname = dirname(fileURLToPath(import.meta.url));

2358const AUTO_UPDATE_INTERVAL = 60 * 60 * 1000; // check every hour

2359

2360function tryAutoUpdate() {

2361 try {

2362 // Слепое пятно git pull: в дев-дереве репо уезжает вперёд ЛОКАЛЬНЫМИ

2363 // коммитами (bump-on-change поднимает версию при правках mcp-server),

2364 // и pull отвечает «Already up to date», не замечая смены кода под

2365 // процессом. Поэтому версия из package.json на диске сверяется с

2366 // запущенной ПЕРВЫМ делом — расхождение само по себе повод к рестарту.

2367 const diskVersion = createRequire(import.meta.url)('./package.json').version;

2368 if (cmpVersion(diskVersion, PKG.version) !== 0) {

2369 log(`Version on disk is ${diskVersion}, running ${PKG.version} — restarting to pick it up...`);

2370 log('Shutting down gracefully...');

2371 setTimeout(() => process.exit(0), 2000);

2372 return;

2373 }

2374 execSync('git rev-parse --git-dir', { cwd: __dirname, stdio: 'ignore' });

2375 const before = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

2376 execSync('git pull --ff-only', { cwd: __dirname, stdio: 'ignore', timeout: 15000 });

2377 const after = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

2378 if (before !== after) {

2379 log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`);

2380 try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {}

2381 // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L2379

2382 log('Shutting down gracefully...');

2383 setTimeout(() => process.exit(0), 2000);

2384 }

2385 } catch { /* not a git repo or offline — skip */ }

2386}

2387

2388async function main() {

2389 tryAutoUpdate();

2390 setInterval(tryAutoUpdate, AUTO_UPDATE_INTERVAL);

2391

2392 // Не ждём: запуск сервера не должен зависеть от доступности реестра npm.

2393 checkForUpdate();

2394 setInterval(checkForUpdate, UPDATE_CHECK_INTERVAL_MS).unref();

2395

2396 log(`integram-mcp ${PKG.version}`);

2397 log(`Connecting to ${BASE_URL}, workspace "${workspace || '(not set)'}"`);

2398

2399 // 1. Login

•matchType = previous_version_dangerous_delta matchedPackage = integram-mcp@0.7.104 matchedIdentity = npm:aW50ZWdyYW0tbWNw:0.7.104 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

Source & flagged code

3 flagged · loading source

index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

2351L2352: import { execSync } from 'child_process'; L2353: import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2351

2379log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L2380: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L2381: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L2379

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltaindex.js

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to integram-mcp@0.7.146.

See all versions of integram-mcp for other recorded verdicts.

Review the evidence and your use of integram-mcp@0.7.146 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 10:12:17.256Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.