registry / Remote code execution / integram-mcp / 0.7.69

integram-mcp@0.7.69

MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Automatic Git pulling followed by npm installation is an unnecessary remote-update execution path. It is conditional on a Git checkout and lacks evidence of a specific malicious payload, so a warning is appropriate rather than a block.

Static reason

One or more suspicious static signals were detected.

Trigger

Executing the package binary from a Git repository activates the update check on startup and then hourly.

Impact

A changed configured Git remote can cause newly fetched package source and dependency installation code to run in the user's environment.

Mechanism

It runs Git pull in its own directory and, after a changed revision, invokes npm install.

AI rationale

Evidence

index.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes index.js as its executable and has no registry install lifecycle hook.
Running the executable enters main automatically.
Main starts the automatic update routine immediately and schedules it hourly.
The update routine pulls the configured Git remote and runs npm install after a changed revision.

Evidence against

The automatic update path first requires the installed directory to be a Git repository.
Authentication requests are sent to the configured Integram base URL with an in-memory token.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 259 KB of source, external domains: api.example.com, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

index.jsView file

Lines 3020-3076javascript

3020 rememberActivation();

3021 workspace = slug;

3022

3023 // Загрузить инструменты целевого воркспейса: ядро + восстановленная

3024 // из памяти активация (инцидент 05.09.2026 — см. блок у activationMemory).

3025 const { tools, restored } = await loadWorkspaceTools(slug);

3026

3027 log(`Switched to workspace "${slug}", ${activeTools.size} tools loaded (${restored} restored from memory)`);

3028

3029 return {

3030 content: [{ type: 'text', text: `Switched to workspace "${slug}". Loaded ${tools.length} tools (${activeTools.size} active${restored ? `, ${restored} restored from previous activation` : ', core only'}). Use search_tools to activate more.` }],

3031 };

3032 } catch (err) {

3033 return { content: [{ type: 'text', text: `Error switching workspace: ${err.message}` }], isError: true };

3034 }

3035}

3036

3037// ─── Bootstrap ───────────────────────────────────────────────────────────────

3038

3039// ─── Auto-update from git ────────────────────────────────────────────────────

3040

3041import { execSync } from 'child_process';

3042import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3040

3043import { dirname } from 'path';

3044import { fileURLToPath } from 'url';

3045

3046const __dirname = dirname(fileURLToPath(import.meta.url));

3047const AUTO_UPDATE_INTERVAL = 60 * 60 * 1000; // check every hour

3048

3049function tryAutoUpdate() {

3050 try {

3051 execSync('git rev-parse --git-dir', { cwd: __dirname, stdio: 'ignore' });

3052 const before = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

3053 execSync('git pull --ff-only', { cwd: __dirname, stdio: 'ignore', timeout: 15000 });

3054 const after = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

3055 if (before !== after) {

3056 log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`);

3057 try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {}

3058 // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3056

3059 log('Shutting down gracefully...');

3060 setTimeout(() => process.exit(0), 2000);

3061 }

3062 } catch { /* not a git repo or offline — skip */ }

3063}

3064

3065async function main() {

3066 tryAutoUpdate();

3067 setInterval(tryAutoUpdate, AUTO_UPDATE_INTERVAL);

3068

3069 // Не ждём: запуск сервера не должен зависеть от доступности реестра npm.

3070 checkForUpdate();

3071 setInterval(checkForUpdate, UPDATE_CHECK_INTERVAL_MS).unref();

3072

3073 log(`integram-mcp ${PKG.version}`);

3074 log(`Connecting to ${BASE_URL}, workspace "${workspace || '(not set)'}"`);

3075

3076 // 1. Login

package.jsonView file

Lines 1-39json

2 "name": "integram-mcp",

3 "version": "0.7.69",

4 "type": "module",

5 "description": "MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol",

Source & flagged code

3 flagged · loading source

index.jsView file

3040L3041: import { execSync } from 'child_process'; L3042: import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3040

3056log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L3057: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L3058: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3056

package.jsonView file

19"bin": { "integram-mcp": "./index.js" }, "scripts": { "test": "node scripts/check-versions.mjs", "prepublishOnly": "node scripts/check-versions.mjs" }, "files

Medium

Suspicious Lifecycle Evidence

The package exposes index.js as its executable and has no registry install lifecycle hook.

Findings

3 High4 Medium5 Low

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to integram-mcp@0.7.69.

See all versions of integram-mcp for other recorded verdicts.

Review the evidence and your use of integram-mcp@0.7.69 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 09:48:49.215Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.