Loading npm security reports…

koragraphmcp@0.1.3: AI-agent control-surface risk | LPM Firewall

registry / koragraphmcp / 0.1.3

koragraphmcp@0.1.3

Local multi-repo code-graph MCP server

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently adds KORAINIT.md to the consumer project. That file is an agent prompt that directs subsequent writes into broadly loaded AI-agent instruction files.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation followed by a coding agent opening the copied KORAINIT.md

Impact

A package-controlled prompt can cause an agent to add persistent Koragraph instructions and hooks to a consumer repository.

Mechanism

install-time prompt seeding that induces AI-agent control-file mutation

Policy narrative

On npm install, the package copies KORAINIT.md into the consuming project without consent. The copied file directly instructs a coding agent to execute Koragraph commands. Its requested sync operation writes a managed block into AGENTS.md and other loaded agent-instruction files; the package also provides code to register Claude hook commands. This is an install-seeded path to persistent control of a foreign repository’s AI-agent context.

Rationale

The automatic lifecycle write is not benign documentation: it plants an AI-directed instruction file in the consumer project that explicitly drives broad agent control-surface changes. This satisfies unconsented install-time AI-agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.jsKORAINIT.mdsrc/practice/sync.jssrc/services/practice-hooks.jsAGENTS.mdCLAUDE.md.cursor/rules/koragraph.mdc.clinerules/koragraph.md

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 31

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/koragraph.jsView file

3L4: require('../src/cli/main') L5: .run(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/koragraph.jsView on unpkg · L3

src/services/lsp/java-lsp-client.jsView file

26L27: const { execSync, spawn } = require('child_process'); L28: const path = require('path'); ... L37: function envInt(name, fallback) { L38: const raw = process.env[name]; L39: if (raw === undefined || raw === '') return fallback; ... L90: buf = buf.slice(bodyStart + len); L91: try { onMessage(JSON.parse(body)); } catch {} L92: } ... L143: // Two ingests of one repo derive the SAME workspace dir, and jdt-ls would lose the second to L144: // its own workspace lock and silently yield 0 edges, so give the loser a private dir instead; L145: // the reaper collects it later.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/services/lsp/java-lsp-client.jsView on unpkg · L26

scripts/postinstall.jsView file

18try { L19: fs.copyFileSync(source, target); L20: console.log('\nkoragraph: added KORAINIT.md to your project root.'); L21: console.log('Open it with your coding agent (e.g. "@KORAINIT.md go" in Claude Code, Cursor, or Copilot) to import your existing CLAUDE.md/AGENTS.md into koragraph.\n'); L22: } catch {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L18

src/services/runtime-trace/tracer.pyView file

•path = src/services/runtime-trace/tracer.py kind = build_helper sizeBytes = 6602 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/services/runtime-trace/tracer.pyView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 19-55json

19 },

20 "bugs": {

21 "url": "https://github.com/Koragraph/KoragraphMCP/issues"

22 },

23 "homepage": "https://www.koragraph.in/",

24 "bin": {

25 "koragraph": "bin/koragraph.js"

26 },

27 "files": [

28 "bin/",

29 "src/",

30 "scripts/",

31 ".claude/hooks/",

32 ".env.example",

33 "KORAINIT.md"

34 ],

35 "engines": {

36 "node": ">=22"

37 },

38 "scripts": {

39 "postinstall": "node scripts/postinstall.js || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 },

41 "dependencies": {

42 "@vscode/tree-sitter-wasm": "^0.3.1",

43 "better-sqlite3": "^13.0.3",

44 "dotenv": "^16.4.5",

45 "joi": "^18.1.2",

46 "js-yaml": "^5.2.1",

47 "node-sql-parser": "^5.4.0",

48 "tree-sitter-wasms": "^0.1.13",

49 "web-tree-sitter": "^0.24.7",

50 "web-tree-sitter-next": "npm:web-tree-sitter@^0.26.12",

51 "winston": "^3.19.0",

52 "winston-daily-rotate-file": "^5.0.0"

53 }

54}

55

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 31

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

bin/koragraph.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2'use strict';

3

4require('../src/cli/main')

5 .run(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/koragraph.jsView on unpkg · L3

6 .then

src/services/lsp/java-lsp-client.jsView file

Lines 6-46javascript

6//

7// Uses callHierarchy/outgoingCalls (not textDocument/references) because Spring

8// controller methods are invoked by the framework via HTTP dispatch, not called

9// directly from Java source — references returns 0 for them.

10//

11// Workspace is cached at $TMPDIR/jdtls-ws-<hash> to avoid re-downloading Maven/

12// Gradle deps on subsequent runs. Cold workspaces (first ingest) can take 5–15

13// minutes to download dependencies — the ingest caller passes timeoutMs: 90_000

14// which will degrade gracefully (0 LSP edges) for cold workspaces.

15

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2'use strict';

3

4const fs = require('fs');

5const path = require('path');

src/services/runtime-trace/tracer.pyView file

•path = src/services/runtime-trace/tracer.py kind = build_helper sizeBytes = 6602 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/services/runtime-trace/tracer.pyView on unpkg