Loading npm security reports…

kogiqa-mcp@1.3.80: AI-agent control-surface risk | LPM Firewall

registry / kogiqa-mcp / 1.3.80

kogiqa-mcp@1.3.80

This web browser has been designed to help your agent debug and develop complex web applications.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall writes this MCP server into every detected coding agent and downloads an unsigned native zip from updater.kogiqa.com into the user home directory. The MCP proxy later starts that dropped binary.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install of kogiqa-mcp, which runs postinstall, then any later start of the kogiqa-mcp binary or MCP server.

Impact

Every supported agent on the machine can be silently given this MCP server, and an unverified native executable is extracted, marked executable, and spawned.

Mechanism

unconsented postinstall agent-config writes plus unsigned remote binary install

Policy narrative

Installing kogiqa-mcp runs postInstall.js, which walks every coding agent found by add-mcp and writes a kogiQA MCP entry that launches npx -y kogiqa-mcp. It then downloads an unsigned platform zip from updater.kogiqa.com, extracts it with unzip or PowerShell into the user home directory, and marks the binary executable. When the MCP proxy starts, it spawns that dropped binary. Agents on the machine therefore receive an unsolicited MCP server backed by an unverified native payload.

AI rationale

npm postinstall mutates every detected coding-agent MCP config and then fetches an unsigned native zip from updater.kogiqa.com with no integrity check. That is unconsented foreign agent-control-surface mutation plus remote payload install, so the package is blocked.

Evidence

package.jsonpostInstall.jsautoRegister.jsdownloadeBinary.js

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postInstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5scripts.postinstall = node postInstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L5: * distributed, or modified without explicit written permission from L6: * atagon GmbH. https://www.atagon.com L7: * ... L16: export const version = "0.5.1131"; L17: export const baseURL = "https://updater.kogiqa.com/release"; L18: export const preferredPort = 4239; L7: * distributed, or modified without explicit written permission from L8: * atagon GmbH. https://www.atagon.com L9: * ... L14: import {pipeline} from "stream/promises"; L15: import axios from "axios"; L16: import {extractZip, getAppBinPath, getDownloadUrl} from "./helper.js"; L17: import {baseDirname, baseURL, extractedPath, versio

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

downloadeBinary.jsView file

7* distributed, or modified without explicit written permission from L8: * atagon GmbH. https://www.atagon.com L9: * ... L44: const progress = total ? `${((downloaded / total) * 100).toFixed(1)}%` : `${(downloaded / 1e6).toFixed(2)} MB`; L45: process.stdout.write(`\r[Proxy] Downloading... ${progress}`); L46: }); ... L54: if (fs.existsSync(appBinPath)) { L55: if (process.platform !== "win32") { L56: fs.chmodSync(appBinPath, 0o755);

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

downloadeBinary.jsView on unpkg · L7

index.jsView file

•matchType = normalized_sha256 matchedPackage = kogiqa-mcp@1.3.103 matchedPath = index.js matchedIdentity = npm:a29naXFhLW1jcA:1.3.103 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 66b783e32bab7692 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = kogiqa-mcp@1.3.103 matchedPath = index.js matchedIdentity = npm:a29naXFhLW1jcA:1.3.103 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = kogiqa-mcp@1.3.29 matchedIdentity = npm:a29naXFhLW1jcA:1.3.29 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

helper.jsView file

•matchType = normalized_sha256 matchedPackage = kogiqa-mcp@1.3.103 matchedPath = helper.js matchedIdentity = npm:a29naXFhLW1jcA:1.3.103 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

helper.jsView on unpkg

updateToolList.jsView file

•matchType = normalized_sha256 matchedPackage = kogiqa-mcp@1.3.103 matchedPath = updateToolList.js matchedIdentity = npm:a29naXFhLW1jcA:1.3.103 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

updateToolList.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-56json

1{

2 "version": "1.3.80",

3 "name": "kogiqa-mcp",

4 "description": "This web browser has been designed to help your agent debug and develop complex web applications.",

5 "keywords": [

6 "mcp",

7 "model context protocol",

8 "kogiqa",

9 "atagon",

10 "qa",

11 "testing",

12 "ai",

13 "integration",

14 "llm",

15 "ai webbrowser",

16 "mcp-server"

17 ],

18 "repository": {

19 "type": "git",

20 "url": "git+https://github.com/atagon-GmbH/kogiqa-mcp.git"

21 },

22 "bugs": {

23 "url": "https://github.com/atagon-GmbH/kogiqa-mcp/issues"

24 },

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

25 "mcpName": "com.atagon/kogiqa-mcp",

26 "type": "module",

27 "main": "index.js",

28 "types": "./types/index.d.ts",

29 "homepage": "https://kogiqa.com",

30 "author": {

31 "name": "atagon GmbH"

32 },

33 "license": "MIT",

34 "engines": {

35 "node": ">=20.0"

36 },

37 "bin": {

38 "kogiqa-mcp": "index.js"

39 },

40 "scripts": {

41 "postinstall": "node postInstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

42 "inspect": "npx @modelcontextprotocol/inspector node index.js",

43 "inspect2": "CLIENT_PORT=5174 SERVER_PORT=5175 npx @modelcontextprotocol/inspector node index.js",

44 "publishNew": "npm run build:types && npm publish",

45 "build:types": "tsc -p tsconfig.json"

46 },

47 "dependencies": {

48 "@modelcontextprotocol/sdk": "^1.29.0",

49 "add-mcp": "^1.13.0",

50 "axios": "^1.18.1"

51 },

52 "devDependencies": {

53 "@types/node": "^26.0.1"

54 }

55}

56

downloadeBinary.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3/*

4 * Copyright (c) 2026. atagon GmbH. All rights reserved.

5 *

6 * This file is part of the atagon codebase and may not be copied,

7 * distributed, or modified without explicit written permission from

8 * atagon GmbH. https://www.atagon.com

9 *

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

downloadeBinary.jsView on unpkg · L7

index.jsView file

•matchType = normalized_sha256 matchedPackage = kogiqa-mcp@1.3.103 matchedPath = index.js matchedIdentity = npm:a29naXFhLW1jcA:1.3.103 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 66b783e32bab7692 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = kogiqa-mcp@1.3.103 matchedPath = index.js matchedIdentity = npm:a29naXFhLW1jcA:1.3.103 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = kogiqa-mcp@1.3.29 matchedIdentity = npm:a29naXFhLW1jcA:1.3.29 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

helper.jsView file

•matchType = normalized_sha256 matchedPackage = kogiqa-mcp@1.3.103 matchedPath = helper.js matchedIdentity = npm:a29naXFhLW1jcA:1.3.103 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

helper.jsView on unpkg

updateToolList.jsView file

•matchType = normalized_sha256 matchedPackage = kogiqa-mcp@1.3.103 matchedPath = updateToolList.js matchedIdentity = npm:a29naXFhLW1jcA:1.3.103 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

updateToolList.jsView on unpkg