registry / Remote code execution / integram-mcp / 0.7.99

integram-mcp@0.7.99

MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Automatic Git pulls followed by dependency installation are an unnecessary unattended code-update capability in a runtime entrypoint. The Git-checkout condition and absence of a demonstrated hostile destination make this a warning rather than a confirmed malicious attack.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the package as its command-line program, then each hourly timer.

Impact

A configured Git remote can supply changed package code and dependency installation during normal program execution. No confirmed hostile remote or payload was found.

Mechanism

The program performs a fast-forward Git pull in its own directory and, after a revision change, invokes npm install.

AI rationale

Evidence

index.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes index.js as its command-line entrypoint.
The entrypoint pulls from its configured Git remote and runs npm install when the revision changes.
The updater runs immediately at program startup and repeats hourly.

Evidence against

package.json has no install lifecycle hook.
No fixed hostile endpoint, credential export, or payload was identified in the inspected code.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 268 KB of source, external domains: api.example.com, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

index.jsView file

Lines 3077-3133javascript

3077 rememberActivation();

3078 workspace = slug;

3079

3080 // Загрузить инструменты целевого воркспейса: ядро + восстановленная

3081 // из памяти активация (инцидент 05.09.2026 — см. блок у activationMemory).

3082 const { tools, restored } = await loadWorkspaceTools(slug);

3083

3084 log(`Switched to workspace "${slug}", ${activeTools.size} tools loaded (${restored} restored from memory)`);

3085

3086 return {

3087 content: [{ type: 'text', text: `Switched to workspace "${slug}". Loaded ${tools.length} tools (${activeTools.size} active${restored ? `, ${restored} restored from previous activation` : ', core only'}). Use search_tools to activate more.` }],

3088 };

3089 } catch (err) {

3090 return { content: [{ type: 'text', text: `Error switching workspace: ${err.message}` }], isError: true };

3091 }

3092}

3093

3094// ─── Bootstrap ───────────────────────────────────────────────────────────────

3095

3096// ─── Auto-update from git ────────────────────────────────────────────────────

3097

3098import { execSync } from 'child_process';

3099import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3097

3100import { dirname } from 'path';

3101import { fileURLToPath } from 'url';

3102

3103const __dirname = dirname(fileURLToPath(import.meta.url));

3104const AUTO_UPDATE_INTERVAL = 60 * 60 * 1000; // check every hour

3105

3106function tryAutoUpdate() {

3107 try {

3108 execSync('git rev-parse --git-dir', { cwd: __dirname, stdio: 'ignore' });

3109 const before = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

3110 execSync('git pull --ff-only', { cwd: __dirname, stdio: 'ignore', timeout: 15000 });

3111 const after = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

3112 if (before !== after) {

3113 log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`);

3114 try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {}

3115 // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3113

3116 log('Shutting down gracefully...');

3117 setTimeout(() => process.exit(0), 2000);

3118 }

3119 } catch { /* not a git repo or offline — skip */ }

3120}

3121

3122async function main() {

3123 tryAutoUpdate();

3124 setInterval(tryAutoUpdate, AUTO_UPDATE_INTERVAL);

3125

3126 // Не ждём: запуск сервера не должен зависеть от доступности реестра npm.

3127 checkForUpdate();

3128 setInterval(checkForUpdate, UPDATE_CHECK_INTERVAL_MS).unref();

3129

3130 log(`integram-mcp ${PKG.version}`);

3131 log(`Connecting to ${BASE_URL}, workspace "${workspace || '(not set)'}"`);

3132

3133 // 1. Login

package.jsonView file

Lines 1-39json

2 "name": "integram-mcp",

3 "version": "0.7.99",

4 "type": "module",

5 "description": "MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol",

Source & flagged code

3 flagged · loading source

index.jsView file

3097L3098: import { execSync } from 'child_process'; L3099: import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3097

3113log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L3114: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L3115: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3113

package.jsonView file

19"bin": { "integram-mcp": "./index.js" }, "scripts": { "test": "node scripts/check-versions.mjs", "prepublishOnly

Medium

Ai Review Evidence

The package exposes index.js as its command-line entrypoint.

package.jsonView on unpkg · L19

Findings

3 High4 Medium5 Low

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to integram-mcp@0.7.99.

See all versions of integram-mcp for other recorded verdicts.

Review the evidence and your use of integram-mcp@0.7.99 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 04:13:17.816Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.