registry / koragraphmcp / 0.2.0
koragraphmcp@0.2.0
Local multi-repo code-graph MCP server
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes an unconsented install-time project mutation and user-command-driven agent and Git hook persistence. It does not establish the narrower concrete malicious chain required for a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Local npm installation, followed by an agent acting on KORAINIT.md or a user running koragraph ingest or practice sync.
Impact
The package can steer coding-agent behavior and arrange later local command execution in a target repository.
Mechanism
Consumer-project onboarding and agent-extension hook installation.
AI rationale
The source establishes an unconsented install-time project mutation and user-command-driven agent and Git hook persistence. It does not establish the narrower concrete malicious chain required for a publish block.
Evidence
scripts/postinstall.jsKORAINIT.mdsrc/cli/ingest.jssrc/services/practice-hooks.js.claude/settings.json.git/hooks/post-commit.git/hooks/post-checkout.git/hooks/post-merge.git/hooks/post-rewriteAGENTS.mdCLAUDE.md.cursor/rules/koragraph.mdc.clinerules/koragraph.md.windsurfrules.github/copilot-instructions.mdGEMINI.md
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The automatic postinstall hook writes KORAINIT.md into a consumer project without an explicit setup command.
- The installed onboarding file instructs an agent to create or refresh agent instruction files for several vendors.
- The ingest command automatically installs Claude Code command hooks and Git hooks unless the user opts out.
- The hook installer writes command entries to the target repository's .claude/settings.json.
Evidence against
- The postinstall hook only copies a local Markdown file and exits for global installs.
- No credential harvesting, outbound network client, remote payload download, or self-dependency was found in the inspected paths.
- Agent and Git hook changes occur through package commands, not directly during postinstall.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 30
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsrc/services/lsp/java-lsp-client.jsView file
Findings
1 Critical11 High5 Medium5 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedpackage.json
HighKnown Malware Source Similaritysrc/db/pool.js
HighKnown Malware Source Similaritysrc/services/ingest.js
HighKnown Malware Source Similaritysrc/services/vcs/git-clone.js
HighKnown Malware Source Similaritysrc/cli/serve.js
HighKnown Malware Source Similaritysrc/services/cochange-defer.js
HighKnown Malware Source Similaritysrc/services/contract-config.js
HighKnown Malware Source Similaritysrc/services/git-coupling-analyzer.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to koragraphmcp@0.2.0.
See all versions of koragraphmcp for other recorded verdicts.
- Review the evidence and your use of koragraphmcp@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.