Loading npm security reports…

kogiqa-mcp@1.3.103: Malicious npm security report (Block) | LPM Firewall

registry / kogiqa-mcp / 1.3.103

kogiqa-mcp@1.3.103

This web browser has been designed to help your agent debug and develop complex web applications.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

On npm postinstall, the package automatically changes every detected coding agent configuration and downloads a remote native archive. The archive is extracted into the user's home directory and executed when the MCP server starts.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation triggers postinstall; starting the MCP command executes the downloaded binary.

Impact

It persists an npx-based MCP entry across detected agent control surfaces and grants a remotely supplied native program execution on the user's machine.

Mechanism

Automatic global agent registration plus unverified remote native payload installation.

Attack narrative

Installing the package runs postInstall.js automatically. That script discovers global coding agents and upserts an MCP configuration for each one, pointing to npx -y kogiqa-mcp. It also downloads a platform-specific zip from updater.kogiqa.com, extracts it under ~/.kogiqa-mcp, and marks the expected binary executable. The normal MCP entrypoint starts that downloaded binary. The install-time broad agent-control mutation combined with an unchecked remote native payload forms a concrete supply-chain persistence and execution chain.

AI rationale

This is malicious under the install-control-surface policy: postinstall modifies all detected coding-agent configurations without user consent while installing a remote executable payload. The package supplies no archive hash, signature, or other integrity verification before extraction and execution.

Evidence

package.jsonpostInstall.jsautoRegister.jsdownloadeBinary.jsconfig.jsindex.js~/.kogiqa-mcp/kogiqa.zip

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postInstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5scripts.postinstall = node postInstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L5: * distributed, or modified without explicit written permission from L6: * atagon GmbH. https://www.atagon.com L7: * ... L16: export const version = "0.5.1131"; L17: export const baseURL = "https://updater.kogiqa.com/release"; L18: export const preferredPort = 4239; L7: * distributed, or modified without explicit written permission from L8: * atagon GmbH. https://www.atagon.com L9: * ... L14: import {pipeline} from "stream/promises"; L15: import axios from "axios"; L16: import {extractZip, getAppBinPath, getDownloadUrl} from "./helper.js"; L17: import {baseDirname, baseURL, extractedPath, versio

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

40"scripts": { "postinstall": "node postInstall.js", "inspect": "npx @modelcontextprotocol/inspector node index.js",

High

Suspicious Lifecycle Evidence

The install hook runs both agent auto-registration and native-binary download.

package.jsonView on unpkg · L40

downloadeBinary.jsView file

7* distributed, or modified without explicit written permission from L8: * atagon GmbH. https://www.atagon.com L9: * ... L44: const progress = total ? `${((downloaded / total) * 100).toFixed(1)}%` : `${(downloaded / 1e6).toFixed(2)} MB`; L45: process.stdout.write(`\r[Proxy] Downloading... ${progress}`); L46: }); ... L54: if (fs.existsSync(appBinPath)) { L55: if (process.platform !== "win32") { L56: fs.chmodSync(appBinPath, 0o755);

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

downloadeBinary.jsView on unpkg · L7

38const response = await axios.get(appDownloadURL, {responseType: 'stream'}); const total = Number.parseFloat(response.headers['content-length'].toString()); let downloaded = 0; response.data.on('data', (chunk) => { downloaded += chunk.length; const progress = total ? `${((downloaded / total) * 100).toFixed(1)}%` : `${(downloaded / 1e6).toFixed(2)} MB`; process.stdout.write(`\r[Proxy] Downloading... ${progress}`); }); await pipeline(response.data, fs.createWriteStream(zipPath)); console.log('\n[Proxy] Download complete.'); extractZip(zip

High

Ai Review Evidence

It downloads, extracts, chmods, and later executes a remote native binary.

downloadeBinary.jsView on unpkg · L38

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kogiqa-mcp@1.3.29 matchedIdentity = npm:a29naXFhLW1jcA:1.3.29 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

postInstall.jsView file

12import downloadeBinary from "./downloadeBinary.js"; import autoRegisterMCP from "./autoRegister.js"; await autoRegisterMCP() await downloadeBinary()

High

Suspicious Lifecycle Evidence

The install hook runs both agent auto-registration and native-binary download.

postInstall.jsView on unpkg · L12

autoRegister.jsView file

7const globalAgents = await detectGlobalAgents(); if (!globalAgents || globalAgents.length === 0) { console.log('No supported coding agents found on this system.'); return; } console.log(`Found ${globalAgents.length} agents. \n`); for (const agent of globalAgents) { try { await upsertServer(agent, "kogiQA-mcp-browser", { command: "npx", args: ["-y", "kogiqa-mcp"], });

High

Ai Review Evidence

It detects all global coding agents and writes an npx server entry to each.

autoRegister.jsView on unpkg · L7

Source & flagged code

8 flagged

package.jsonView file

Lines 1-56json

1{

2 "version": "1.3.103",

3 "name": "kogiqa-mcp",

4 "description": "This web browser has been designed to help your agent debug and develop complex web applications.",

5 "keywords": [

6 "mcp",

7 "model context protocol",

8 "kogiqa",

9 "atagon",

10 "qa",

11 "testing",

12 "ai",

13 "integration",

14 "llm",

15 "ai webbrowser",

16 "mcp-server"

17 ],

18 "repository": {

19 "type": "git",

20 "url": "git+https://github.com/atagon-GmbH/kogiqa-mcp.git"

21 },

22 "bugs": {

23 "url": "https://github.com/atagon-GmbH/kogiqa-mcp/issues"

24 },

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

25 "mcpName": "com.atagon/kogiqa-mcp",

26 "type": "module",

27 "main": "index.js",

28 "types": "./types/index.d.ts",

29 "homepage": "https://kogiqa.com",

30 "author": {

31 "name": "atagon GmbH"

32 },

33 "license": "MIT",

34 "engines": {

35 "node": ">=20.0"

36 },

37 "bin": {

38 "kogiqa-mcp": "index.js"

39 },

40 "scripts": {

41 "postinstall": "node postInstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

42 "inspect": "npx @modelcontextprotocol/inspector node index.js",

High

Suspicious Lifecycle Evidence

The install hook runs both agent auto-registration and native-binary download.

package.jsonView on unpkg · L40

43 "inspect2": "CLIENT_PORT=5174 SERVER_PORT=5175 npx @modelcontextprotocol/inspector node index.js",

44 "publishNew": "npm run build:types && npm publish",

45 "build:types": "tsc -p tsconfig.json"

46 },

47 "dependencies": {

48 "@modelcontextprotocol/sdk": "^1.29.0",

49 "add-mcp": "^1.13.0",

50 "axios": "^1.18.1"

51 },

52 "devDependencies": {

53 "@types/node": "^26.0.1"

54 }

55}

56

downloadeBinary.jsView file

Lines 1-58javascript

1#!/usr/bin/env node

2

3/*

4 * Copyright (c) 2026. atagon GmbH. All rights reserved.

5 *

6 * This file is part of the atagon codebase and may not be copied,

7 * distributed, or modified without explicit written permission from

8 * atagon GmbH. https://www.atagon.com

9 *

10 */

11

12import

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kogiqa-mcp@1.3.29 matchedIdentity = npm:a29naXFhLW1jcA:1.3.29 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

postInstall.jsView file

Lines 1-17javascript

1

2/*

3 * Copyright (c) 2026. atagon GmbH. All rights reserved.

4 *

5 * This file is part of the atagon codebase and may not be copied,

6 * distributed, or modified without explicit written permission from

7 * atagon GmbH. https://www.atagon.com

8 *

9 *

10 */

11

12import downloadeBinary

autoRegister.jsView file

Lines 1-27javascript

1import { detectGlobalAgents, upsertServer } from "add-mcp";

2

3 async function autoRegisterMCP() {

4 console.log('Detecting coding agents...');

5

6 try {