Loading npm security reports…

mercury-agent@0.5.13: Suspicious npm security report (Warn) | LPM Firewall

registry / mercury-agent / 0.5.13

mercury-agent@0.5.13

Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)

AI Security Review

scanned 15d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Mercury is an AI agent platform that can install its own skills/extensions and run containerized pi agents after the user starts the service. The residual risk is platform extension lifecycle and agent capability exposure, not confirmed malware.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs mercury setup/init/run/service install/add or starts Mercury.

Impact

User-configured Mercury agents may receive project credentials and operate with installed Mercury skills/extensions; no unconsented npm lifecycle attack was found.

Mechanism

first-party Mercury extension and skill installation plus containerized agent execution

Policy narrative

No concrete attack chain was confirmed. The package exposes powerful agent-platform behavior: explicit CLI/service commands initialize a Mercury project, write project data, install Mercury-owned skills/extensions, and run pi agents in containers. Those actions are package-aligned and user-invoked, with no npm lifecycle hook or foreign AI-agent control-surface mutation observed.

Rationale

Source inspection supports a warning for first-party agent extension lifecycle risk and dangerous agent capabilities, but not a publish block. Scanner credential-exfiltration hints map to setup/runtime credential handling and provider/Mercury-console token flows rather than hidden harvesting.

Evidence

package.jsonsrc/cli/mercury.tssrc/main.tssrc/extensions/installer.tssrc/extensions/skills.tssrc/agent/container-entry.tssrc/agent/container-runner.ts

Source & flagged code

9 flagged · loading source

resources/pi-extensions/subagent/index.tsView file

14L15: import { spawn } from "node:child_process"; L16: import * as fs from "node:fs";

High

Child Process

Package source references child process execution.

resources/pi-extensions/subagent/index.tsView on unpkg · L14

examples/extensions/pinchtab/index.tsView file

10install: L11: 'npm install -g pinchtab@0.13.2 playwright && npx playwright install --with-deps chromium && CHROMIUM=$(NODE_PATH="$(npm root -g)" node -e "try{process.stdout.write(require(\'playw... L12: });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/extensions/pinchtab/index.tsView on unpkg · L10

src/cli/mercury.tsView file

2L3: import { spawn, spawnSync } from "node:child_process"; L4: import { ... L32: L33: const __dirname = dirname(fileURLToPath(import.meta.url)); L34: const PACKAGE_ROOT = join(__dirname, "../.."); ... L56: function isPortInUse(port: string): boolean { L57: if (process.platform === "win32") { L58: const result = spawnSync("netstat", ["-ano"], { ... L61: }); L62: return result.status === 0 && result.stdout.includes(`:${port} `); L63: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/cli/mercury.tsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> src/cli/mercury.ts L2: L3: import { spawn, spawnSync } from "node:child_process"; L4: import { ... L32: L33: const __dirname = dirname(fileURLToPath(import.meta.url)); L34: const PACKAGE_ROOT = join(__dirname, "../.."); ... L56: function isPortInUse(port: string): boolean { L57: if (process.platform === "win32") { L58: const result = spawnSync("netstat", ["-ano"], { ... L61: }); L62: return result.status === 0 && result.stdout.includes(`:${port} `); L63: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/cli/mercury.tsView on unpkg · L2

2Cross-file remote execution chain: src/cli/mercury.ts spawns [redacted].ts; helper contains network access plus dynamic code execution. L2: L3: import { spawn, spawnSync } from "node:child_process"; L4: import { ... L32: L33: const __dirname = dirname(fileURLToPath(import.meta.url)); L34: const PACKAGE_ROOT = join(__dirname, "../.."); ... L56: function isPortInUse(port: string): boolean { L57: if (process.platform === "win32") { L58: const result = spawnSync("netstat", ["-ano"], { ... L61: }); L62: return result.status === 0 && result.stdout.includes(`:${port} `); L63: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/cli/mercury.tsView on unpkg · L2

2L3: import { spawn, spawnSync } from "node:child_process"; L4: import { ... L32: L33: const __dirname = dirname(fileURLToPath(import.meta.url)); L34: const PACKAGE_ROOT = join(__dirname, "../.."); ... L56: function isPortInUse(port: string): boolean { L57: if (process.platform === "win32") { L58: const result = spawnSync("netstat", ["-ano"], { ... L61: }); L62: return result.status === 0 && result.stdout.includes(`:${port} `); L63: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/mercury.tsView on unpkg · L2

container/build.shView file

•path = container/build.sh kind = build_helper sizeBytes = 623 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

container/build.shView on unpkg

examples/extensions/pdf/skill/SKILL.mdView file

442patternName = generic_password severity = medium line = 442 matchedText = user_pas...ss",

Medium

Secret Pattern

Hardcoded password in examples/extensions/pdf/skill/SKILL.md

examples/extensions/pdf/skill/SKILL.mdView on unpkg · L442

443patternName = generic_password severity = medium line = 443 matchedText = owner_pa...ss",

Medium

Secret Pattern

Hardcoded password in examples/extensions/pdf/skill/SKILL.md

examples/extensions/pdf/skill/SKILL.mdView on unpkg · L443