registry / mcp-computrabajo-open / 1.0.1

mcp-computrabajo-open@1.0.1

A Model Context Protocol (MCP) server for accessing Computrabajo job listings in Latin America

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the global Claude skills directory. An explicit remote-login command also transmits a browser session cookie to the configured remote server, which defaults to a maintainer worker.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs postinstall; remote cookie transfer requires the iniciar-sesion-remota command.

Impact

The package can alter a broad AI-agent control surface without an explicit setup command and can send an authenticated session to an external service.

Mechanism

Install-time global AI-agent skill injection and remote session-cookie transfer.

Policy narrative

On installation, npm runs the postinstall script, which copies every packaged skill into the user's global Claude configuration. This changes the agent's available instructions without a separate user setup action. Separately, the explicit remote-login flow obtains a Computrabajo session cookie and posts it to a remote worker selected from a default maintainer-controlled URL.

AI rationale

The automatic postinstall writes package-controlled content into the global Claude skills control surface, meeting the install-hook abuse boundary. The remote-login cookie transfer adds a concrete credential-exposure path.

Evidence

package.jsonscripts/install-skills.mjsdist/src/index.js~/.claude/skills/<skill>/SKILL.md~/.claude/skills/.mcp-computrabajo-open.json

Network endpoints1

computrabajo-mcp.torres-sergio2205.workers.dev

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The install lifecycle automatically runs a script after npm installation.
That script writes package-controlled skill files into the user's global Claude skills directory.
The runtime remote-login path sends session cookies to a maintainer-controlled default worker endpoint.

Evidence against

The skill installer preserves an existing skill file unless it has this package's marker.
Skill installation can be disabled with an environment variable.
The cookie transfer occurs only through an explicit remote-login command.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 978 KB of source, external domains: 127.0.0.1, candidato.co.computrabajo.com, computrabajo-mcp.torres-sergio2205.workers.dev, github.com, json-schema.org, oferta.computrabajo.com, raw.githubusercontent.com

Source & flagged code

7 flagged

package.jsonView file

Lines 31-71json

31 "sdk",

32 "cheerio",

33 "html",

34 "scraping",

35 "claude"

36 ],

37 "author": "Sergio Torres",

38 "license": "MIT",

39 "files": [

40 "dist/src/*.js",

41 "dist/src/*.d.ts",

42 "ONBOARDING.md",

43 "scripts/install-skills.mjs",

44 "skills/*.md"

45 ],

46 "scripts": {

47 "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && bun build --target=node ./src/index.ts --outdir=dist/src --external playwright --external keytar && bun run build:declaration",

48 "build:declaration": "tsc --emitDeclarationOnly --project tsconfig.types.json",

49 "format": "bunx biome check --write",

50 "prepare": "husky",

51 "postinstall": "node scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

52 "prepublishOnly": "bun run build",

53 "inspect": "bunx @modelcontextprotocol/inspector bun src/index.ts",

54 "typecheck": "bun run cf-typegen && tsc --noEmit --project tsconfig.json && tsc --noEmit --project tsconfig.worker.json",

55 "cf-typegen": "wrangler types",

56 "dev:worker": "wrangler dev",

57 "deploy": "wrangler deploy",

58 "deploy:staging": "wrangler deploy --config wrangler.staging.jsonc",

59 "inspect:worker": "bunx @modelcontextprotocol/inspector",

60 "test": "bun test"

61 },

62 "devDependencies": {

63 "@biomejs/biome": "2.5.7",

64 "@modelcontextprotocol/client": "2.0.0",

65 "@types/bun": "1.3.14",

66 "@types/node": "^22.20.2",

67 "husky": "9.1.7",

68 "typescript": "5.8.3",

69 "wrangler": "^4.130.0"

70 },

71 "peerDependencies": {

dist/src/index.jsView file

144var high = parseInt(escaped, 16) - 65536; L145: return high !== high || escapedWhitespace ? escaped : high < 0 ? String.fromCharCode(high + 65536) : String.fromCharCode(high >> 10 | 55296, high & 1023 | 56320); L146: } ... L363: name: getName(2).toLowerCase(), L364: data: selector.charCodeAt(selectorIndex) === 40 ? readValueWithParenthesis() : null L365: }); ... L619: L620: // package.json L621: var name = "mcp-computrabajo-open"; ... L642: // src/config/node-config.ts L643: var DEFAULT_COOKIE_FILE = join(homedir(), ".computrabajo", "cookies.txt"); L644: function getCookies() {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/src/index.jsView on unpkg · L144

144Trigger-reachable chain: manifest.main -> dist/src/index.js L144: var high = parseInt(escaped, 16) - 65536; L145: return high !== high || escapedWhitespace ? escaped : high < 0 ? String.fromCharCode(high + 65536) : String.fromCharCode(high >> 10 | 55296, high & 1023 | 56320); L146: } ... L363: name: getName(2).toLowerCase(), L364: data: selector.charCodeAt(selectorIndex) === 40 ? readValueWithParenthesis() : null L365: }); ... L619: L620: // package.json L621: var name = "mcp-computrabajo-open"; ... L642: // src/config/node-config.ts L643: var DEFAULT_COOKIE_FILE = join(homedir(), ".computrabajo", "cookies.txt"); L644: function getCookies() {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/index.jsView on unpkg · L144

19989sourceCode = this.opts.code.process(sourceCode, sch); L19990: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L19991: this.scope.value(validateName, { ref: validate });

scripts/install-skills.mjsView file

Lines 1-27javascript

1import { mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";

2import { homedir } from "node:os";

3import { dirname, join } from "node:path";

4import { fileURLToPath } from "node:url"

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/index.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/src/index.jsView on unpkg · L144

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/index.jsView on unpkg · L144

High

Eval

Package source references dynamic code evaluation.

dist/src/index.jsView on unpkg · L19989

144Trigger-reachable credential exfiltration chain: manifest.main -> dist/src/index.js L144: var high = parseInt(escaped, 16) - 65536; L145: return high !== high || escapedWhitespace ? escaped : high < 0 ? String.fromCharCode(high + 65536) : String.fromCharCode(high >> 10 | 55296, high & 1023 | 56320); L146: } ... L363: name: getName(2).toLowerCase(), L364: data: selector.charCodeAt(selectorIndex) === 40 ? readValueWithParenthesis() : null L365: }); ... L619: L620: // package.json L621: var name = "mcp-computrabajo-open"; ... L642: // src/config/node-config.ts L643: var DEFAULT_COOKIE_FILE = join(homedir(), ".computrabajo", "cookies.txt"); L644: function getCookies() {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/src/index.jsView on unpkg · L144

4479patternName = generic_password severity = medium line = 4479

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/index.jsView on unpkg · L4479

scripts/install-skills.mjsView file

7const sourceRoot = join(packageRoot, "skills"); L8: const configRoot = process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude"); L9: const targetRoot = join(configRoot, "skills"); ... L32: L33: await mkdir(targetRoot, { recursive: true }); L34: const installed = []; ... L50: L51: await mkdir(targetDir, { recursive: true }); L52: const content = await readFile(source, "utf8");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skills.mjsView on unpkg · L7

Findings

3 Critical3 High4 Medium5 Low

CriticalCredential Exfiltrationdist/src/index.js

CriticalAi Agent Control Hijackscripts/install-skills.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/src/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighEvaldist/src/index.js

HighTrigger Reachable Credential Exfiltrationdist/src/index.js

MediumSecret Patterndist/src/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to mcp-computrabajo-open@1.0.1.

See version security history for other recorded verdicts.

Avoid installing mcp-computrabajo-open@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-11 04:15:21.120Z (UTC).

98%Malicious

AI assessment confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

This finding concerns changes to an AI agent's instructions or configuration without explicit user action. It does not by itself establish malware intent. The CLI warns by default and blocks when configured for this policy.

Package metadata

npm

AuthorSergio Torres

Version1.0.1

PublishedSep 10, 2026

LicenseMIT

Dependencies7

Integrityverified

Package size214 KB

Files19

Keywordsmcpmodelcontextprotocolservercomputrabajoperujobsemploymentapi

Runtime surface

package.json

Entrypointsmain → dist/src/index.jsmodule → dist/src/index.jstypes → dist/src/index.d.tsexports mapbin → mcp-computrabajo-open

RuntimeNo engine / OS / CPU constraints

Artifact1000 KB · 19 files1 signature(s)

Install lifecyclepostinstallprepareprepublishOnly

Behavioral surface

ChildProcessEnvironmentVarsEvalFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean