registry / Remote code execution / integram-mcp / 0.7.71

integram-mcp@0.7.71

MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol

AI Security Review

scanned 25d ago · by lpm-firewall-ai

No install-time malware or credential-exfiltration path was found, but automatic unverified Git updates followed by npm installation are a concrete unsafe execution capability. The behavior warrants a warning rather than a publication block because it is limited to Git-checkout execution and lacks evidence of a package-controlled malicious recipient.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the package as its command-line program in a Git checkout.

Impact

Pulled repository code and dependency lifecycle code can execute without a separate user update action.

Mechanism

Startup and hourly timers invoke Git pull, then invoke npm install after a changed revision.

AI rationale

Evidence

index.js

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The executable automatically checks whether its own directory is a Git repository, pulls its configured remote, and compares revisions.
When a pull changes the revision, it runs npm install and exits for restart.
The update routine runs on program startup and then every hour.

Evidence against

The package metadata has no npm install lifecycle hook; its listed scripts are test and prepublish-only.
The automatic update path is limited to executions from a Git checkout.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 261 KB of source, external domains: api.example.com, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

index.jsView file

Lines 3027-3083javascript

3027 rememberActivation();

3028 workspace = slug;

3029

3030 // Загрузить инструменты целевого воркспейса: ядро + восстановленная

3031 // из памяти активация (инцидент 05.09.2026 — см. блок у activationMemory).

3032 const { tools, restored } = await loadWorkspaceTools(slug);

3033

3034 log(`Switched to workspace "${slug}", ${activeTools.size} tools loaded (${restored} restored from memory)`);

3035

3036 return {

3037 content: [{ type: 'text', text: `Switched to workspace "${slug}". Loaded ${tools.length} tools (${activeTools.size} active${restored ? `, ${restored} restored from previous activation` : ', core only'}). Use search_tools to activate more.` }],

3038 };

3039 } catch (err) {

3040 return { content: [{ type: 'text', text: `Error switching workspace: ${err.message}` }], isError: true };

3041 }

3042}

3043

3044// ─── Bootstrap ───────────────────────────────────────────────────────────────

3045

3046// ─── Auto-update from git ────────────────────────────────────────────────────

3047

3048import { execSync } from 'child_process';

3049import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3047

3050import { dirname } from 'path';

3051import { fileURLToPath } from 'url';

3052

3053const __dirname = dirname(fileURLToPath(import.meta.url));

3054const AUTO_UPDATE_INTERVAL = 60 * 60 * 1000; // check every hour

3055

3056function tryAutoUpdate() {

3057 try {

3058 execSync('git rev-parse --git-dir', { cwd: __dirname, stdio: 'ignore' });

3059 const before = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

Medium

Ai Review Evidence

The executable automatically checks whether its own directory is a Git repository, pulls its configured remote, and compares revisions.

index.jsView on unpkg · L3048

3060 execSync('git pull --ff-only', { cwd: __dirname, stdio: 'ignore', timeout: 15000 });

3061 const after = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

3062 if (before !== after) {

3063 log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`);

3064 try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {}

3065 // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3063

3066 log('Shutting down gracefully...');

3067 setTimeout(() => process.exit(0), 2000);

3068 }

3069 } catch { /* not a git repo or offline — skip */ }

3070}

3071

3072async function main() {

3073 tryAutoUpdate();

3074 setInterval(tryAutoUpdate, AUTO_UPDATE_INTERVAL);

3075

3076 // Не ждём: запуск сервера не должен зависеть от доступности реестра npm.

3077 checkForUpdate();

3078 setInterval(checkForUpdate, UPDATE_CHECK_INTERVAL_MS).unref();

3079

3080 log(`integram-mcp ${PKG.version}`);

3081 log(`Connecting to ${BASE_URL}, workspace "${workspace || '(not set)'}"`);

3082

3083 // 1. Login

Source & flagged code

3 flagged · loading source

index.jsView file

3047L3048: import { execSync } from 'child_process'; L3049: import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3047

3063log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L3064: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L3065: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3063

3048import { execSync } from 'child_process'; import { realpathSync } from 'fs'; import { dirname } from 'path'; import { fileURLToPath } from 'url'; const __dirname = dirname(fileURLToPath(import.meta.url)); const AUTO_UPDATE_INTERVAL = 60 * 60 * 1000; // check every hour function tryAutoUpdate() { try { execSync('git rev-parse --git-dir', { cwd: __dirname, stdio: 'ignore' }); const before = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim(); execSync('git pull --ff-only', { cwd: __dirname, stdio: 'ignore', timeout: 15000 });

Medium

Ai Review Evidence

The executable automatically checks whether its own directory is a Git repository, pulls its configured remote, and compares revisions.

Findings

3 High4 Medium5 Low

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidenceindex.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to integram-mcp@0.7.71.

See all versions of integram-mcp for other recorded verdicts.

Review the evidence and your use of integram-mcp@0.7.71 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 09:48:47.825Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.