jefrichat-mcp@0.12.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

jefrichat-mcp@0.12.0: Suspicious npm security report (Warn) | LPM Firewall

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/index.js` exposes `jefri_autonomous`, which persists an enabled flag, command, and workdir in `~/.jefri/autonomous.json`.
When enabled, inbound ACP messages are placed into a prompt and `child_process.spawn` launches `claude -p --permission-mode acceptEdits` or `codex exec --full-auto`.
The autonomy tool permits a user-supplied custom command and defaults `ownerOnly` to false, so trusted remote messages can drive a tool-enabled local agent.
Runtime connects to the configured ACP hub using bearer-token HTTP/WebSocket requests and can upload/download user-selected files.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall`; its only lifecycle hook is `prepublishOnly` for building.
Autonomous mode defaults to disabled and is explicitly documented in the MCP tool as remote-message-driven local-agent execution.
No source writes Claude, Codex, Cursor, or other foreign agent configuration; persistence is limited to package-owned `~/.jefri` and `~/.acp` state.
The reported `new Function` is bundled AJV schema compilation, and the invisible Unicode is used in filename normalization rather than concealed control flow.
Network targets derive from user-provided `ACP_SERVER`; no hidden fixed exfiltration endpoint or credential harvesting was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.17 MB of source, external domains: developer.mozilla.org, git.io, github.com, json-schema.org, nodejs.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Oversized source lightweight scan

dist/http.js2.07 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalCryptoShellObfuscatedHighEntropyStringsUrlStringsdeveloper.mozilla.orggit.iostackoverflow.com

Source & flagged code

6 flagged · loading source

dist/index.jsView file

25637contains invisible/control Unicode U+2060 (word joiner) const UNI = /[  <U+2060>]/g;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L25637

•Trigger-reachable chain: manifest.bin -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

1236// validation function arguments L1237: data: new codegen_1.Name("data"), L1238: // data passed to validation function ... L2263: id = normalizeId(id); L2264: return resolver.resolve(baseId, id); L2265: } ... L3126: for (i = 0; i < input.length; i++) { L3127: code = input[i].charCodeAt(0); L3128: if (code === 48) { ... L6979: }; L6980: if (!process.env.WS_NO_BUFFER_UTIL) { L6981: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1236

2952sourceCode = this.opts.code.process(sourceCode, sch); L2953: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2954: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L2952

dist/http.jsView file

•path = dist/http.js kind = oversized_source_file sizeBytes = 2168029 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/http.jsView on unpkg

•path = dist/http.js kind = oversized_cli_entrypoint sizeBytes = 2168029 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/http.jsView on unpkg