registry / Remote code execution / integram-mcp / 0.7.85

integram-mcp@0.7.85

MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol

AI Security Review

scanned 25d ago · by lpm-firewall-ai

No confirmed covert theft or registry-install attack was found. The unattended Git pull followed by npm install is nevertheless a concrete, conditionally activated remote execution capability.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the bin entry point from a Git checkout.

Impact

A compromised or redirected configured Git remote can cause unreviewed code and dependency lifecycle execution.

Mechanism

Startup and an hourly timer run git pull; a changed revision causes npm install and process restart.

AI rationale

No confirmed covert theft or registry-install attack was found. The unattended Git pull followed by npm install is nevertheless a concrete, conditionally activated remote execution capability.

Evidence

index.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes its executable through index.js and has no npm install lifecycle hook.
Program startup invokes an automatic updater immediately and then hourly.
The updater runs git pull in the package directory when that directory is a Git checkout.
After a changed pull, the updater runs npm install automatically.

Evidence against

The automatic update path exits when the installed directory is not a Git repository.
Authentication requests use the configured Integram base URL and caller-provided environment credentials.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 258 KB of source, external domains: api.example.com, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

index.jsView file

Lines 3003-3059javascript

3003 rememberActivation();

3004 workspace = slug;

3005

3006 // Загрузить инструменты целевого воркспейса: ядро + восстановленная

3007 // из памяти активация (инцидент 05.09.2026 — см. блок у activationMemory).

3008 const { tools, restored } = await loadWorkspaceTools(slug);

3009

3010 log(`Switched to workspace "${slug}", ${activeTools.size} tools loaded (${restored} restored from memory)`);

3011

3012 return {

3013 content: [{ type: 'text', text: `Switched to workspace "${slug}". Loaded ${tools.length} tools (${activeTools.size} active${restored ? `, ${restored} restored from previous activation` : ', core only'}). Use search_tools to activate more.` }],

3014 };

3015 } catch (err) {

3016 return { content: [{ type: 'text', text: `Error switching workspace: ${err.message}` }], isError: true };

3017 }

3018}

3019

3020// ─── Bootstrap ───────────────────────────────────────────────────────────────

3021

3022// ─── Auto-update from git ────────────────────────────────────────────────────

3023

3024import { execSync } from 'child_process';

3025import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3023

3026import { dirname } from 'path';

3027import { fileURLToPath } from 'url';

3028

3029const __dirname = dirname(fileURLToPath(import.meta.url));

3030const AUTO_UPDATE_INTERVAL = 60 * 60 * 1000; // check every hour

3031

3032function tryAutoUpdate() {

3033 try {

3034 execSync('git rev-parse --git-dir', { cwd: __dirname, stdio: 'ignore' });

3035 const before = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

3036 execSync('git pull --ff-only', { cwd: __dirname, stdio: 'ignore', timeout: 15000 });

3037 const after = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

3038 if (before !== after) {

3039 log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`);

3040 try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {}

3041 // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3039

3042 log('Shutting down gracefully...');

3043 setTimeout(() => process.exit(0), 2000);

3044 }

3045 } catch { /* not a git repo or offline — skip */ }

3046}

3047

3048async function main() {

3049 tryAutoUpdate();

3050 setInterval(tryAutoUpdate, AUTO_UPDATE_INTERVAL);

3051

3052 // Не ждём: запуск сервера не должен зависеть от доступности реестра npm.

3053 checkForUpdate();

3054 setInterval(checkForUpdate, UPDATE_CHECK_INTERVAL_MS).unref();

3055

3056 log(`integram-mcp ${PKG.version}`);

3057 log(`Connecting to ${BASE_URL}, workspace "${workspace || '(not set)'}"`);

3058

3059 // 1. Login

package.jsonView file

Lines 1-39json

2 "name": "integram-mcp",

3 "version": "0.7.85",

4 "type": "module",

5 "description": "MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol",

Source & flagged code

3 flagged · loading source

index.jsView file

3023L3024: import { execSync } from 'child_process'; L3025: import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3023

3039log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L3040: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L3041: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3039

package.jsonView file

19"bin": { "integram-mcp": "./index.js" }, "scripts": { "test": "node scripts/check-versions.mjs", "prepublishOnly": "node scripts/check-versions.mjs" }, "files": [ "index.js", "activation-mem

Medium

Suspicious Lifecycle Evidence

The package exposes its executable through index.js and has no npm install lifecycle hook.

Findings

3 High4 Medium5 Low

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to integram-mcp@0.7.85.

See all versions of integram-mcp for other recorded verdicts.

Review the evidence and your use of integram-mcp@0.7.85 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 09:57:55.400Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.