Loading npm security reports…

mergen-server@1.5.0: Malicious npm security report (Block) | LPM Firewall

registry / mergen-server / 1.5.0

mergen-server@1.5.0

Mergen — the Execution & Security Gateway for AI agents. Deterministic local gate that blocks destructive tool calls in <1ms before they execute, holds risky calls for Slack HITL approval, and keeps a tamper-evident audit trail. Claude Code/Windsurf PreTo

AI Security Review

scanned 25d ago · by lpm-firewall-ai

When the server starts under a paid plan, it periodically exports sensitive agent activity to the package vendor. The exported records can contain command text, approval data, host identity, and agent metadata.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Start the server with an active non-free license and generate held or blocked agent activity.

Impact

Sensitive commands, reasons, host identity, and agent metadata can leave the machine without a per-upload consent step.

Mechanism

Automatic authenticated uploads of command and audit records to the vendor API.

Attack narrative

After the server starts, it installs repeating background tasks. With a paid license, those tasks upload resolved approval records containing held command arguments, audit records containing blocked command text and reasons, and heartbeat data containing the host name and execution environment to the vendor API. These uploads are automatic rather than initiated for each record.

AI rationale

This is a concrete recurring data-exfiltration path for sensitive agent activity and machine metadata. Although it is limited to paid plans and disclosed in source, the automatic collection is excessive for local enforcement and lacks a per-record consent control.

Evidence

dist/index.jsdist/intelligence/approval-sync.jsdist/intelligence/audit-sync.jsdist/intelligence/heartbeat-sync.js

Network endpoints3

api.mergen.app/v1/runtime/approvals

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

The server automatically schedules approval and audit uploads every five minutes after startup.
Paid-plan approval uploads include held command arguments and approver details.
Paid-plan audit uploads include blocked command text, reasons, service, actor, and agent identity.
The default upload destination is api.mergen.app and uploads use the license key as bearer authentication.
A paid-plan heartbeat sends the host name and execution-environment evidence every minute.
Approval sync sends retained command arguments and approver data in POST requests.
Audit sync sends retained commands, redacted reasons, service, actor, and agent identity.
Heartbeat sync sends the hostname and execution-environment evidence in a POST request.

Evidence against

package.json has no install or postinstall lifecycle hook.
The uploads are gated on a non-free active plan and a license key.
The package source exposes the collection and destination in its configuration registry.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 432 file(s), 3.72 MB of source, external domains: 127.0.0.1, 169.254.169.254, api.acme.com, api.atlassian.com, api.company.com, api.github.com, api.internal.company.com, api.lemonsqueezy.com, api.linear.app, api.mergen.app, api.pagerduty.com, api.slack.com, api.stripe.com, api.twilio.com, app.datadoghq.com, attacker.example, auth.atlassian.com, cdn.jsdelivr.net, checkout.adyen.com, ci.test, company-assets-prod.s3.amazonaws.com, company.my.salesforce.com, deb.nodesource.com, developer.pagerduty.com, discord.com, docs.docker.com, email.us-east-1.amazonaws.com, events.pagerduty.com, evil.example, evil.sh, evil.tgz, example.com, exfil.evil, fonts.googleapis.com, fonts.gstatic.com, get.evil.sh, github.com, hooks.slack.com, iamcredentials.googleapis.com, id.atlassian.com, identity.pagerduty.com, install.attacker.io, install.example.sh, kubernetes.io, linear.app, login.microsoftonline.com, management.azure.com, marketplace.visualstudio.com, mergen.app, mergen.example.com

Source & flagged code

21 flagged · loading source

dist/commands/connect.jsView file

287patternName = generic_password severity = medium line = 287

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/connect.jsView on unpkg · L287

dist/intelligence/git-adr-sync.jsView file

1import { execSync } from "child_process"; L2: import fs from "fs";

High

Child Process

Package source references child process execution.

dist/intelligence/git-adr-sync.jsView on unpkg · L1

dist/intelligence/process-tree.jsView file

17async function listAllProcessesWindows() { L18: const { stdout } = await execFileAsync("powershell", [ L19: "-NoProfile",

High

Shell

Package source references shell execution.

dist/intelligence/process-tree.jsView on unpkg · L17

dist/intelligence/execution-mode.jsView file

20try { L21: const { isOnboardingObservationMode } = require("../sensor/onboarding-window.js"); L22: return isOnboardingObservationMode();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/intelligence/execution-mode.jsView on unpkg · L20

dist/commands/service.jsView file

1Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/commands/service.js L1: import { execFileSync } from "child_process"; L2: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from "fs"; ... L76: function launchdPlistPath(cwd) { L77: return join(homedir(), "Library", "LaunchAgents", `${serviceLabel(cwd)}.plist`); L78: } ... L92: const e = err; L93: return { ok: false, out: (e.stderr || e.stdout || e.message || "").trim() }; L94: } ... L96: async function migrateLegacyService(cwd) { L97: if (process.platform === "darwin") { L98: const legacyPlistPath = legacyLaunchdPlistPath(cwd); ... L101: const uid = typeof process.getuid === "function" ? process.getuid() : 501;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/service.jsView on unpkg · L1

1import { execFileSync } from "child_process"; L2: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from "fs"; ... L76: function launchdPlistPath(cwd) { L77: return join(homedir(), "Library", "LaunchAgents", `${serviceLabel(cwd)}.plist`); L78: } ... L92: const e = err; L93: return { ok: false, out: (e.stderr || e.stdout || e.message || "").trim() }; L94: } ... L96: async function migrateLegacyService(cwd) { L97: if (process.platform === "darwin") { L98: const legacyPlistPath = legacyLaunchdPlistPath(cwd); ... L101: const uid = typeof process.getuid === "function" ? process.getuid() : 501;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/service.jsView on unpkg · L1

dist/commands/incident.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = mergen-server@1.6.0 matchedIdentity = npm:bWVyZ2VuLXNlcnZlcg:1.6.0 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/incident.jsView on unpkg

150process.stdout.write("\u2139 Starting Mergen server..."); L151: const { spawn: spawnSrv } = await import("child_process"); L152: const srv = spawnSrv("node", [serverPath], { ... L154: detached: true, L155: env: { ...process.env, NODE_ENV: "production" } L156: }); ... L161: try { L162: const r = await fetch(`http://${mergenHost}:${p}/health`, { signal: AbortSignal.timeout(300) }); L163: if (r.ok) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/incident.jsView on unpkg · L150

137try { L138: const r = await fetch(`http://${mergenHost}:${p}/health`, { signal: AbortSignal.timeout(500) }); L139: if (r.ok) { ... L149: if (existsSync(serverPath)) { L150: process.stdout.write("\u2139 Starting Mergen server..."); L151: const { spawn: spawnSrv } = await import("child_process"); L152: const srv = spawnSrv("node", [serverPath], {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/commands/setup.jsView file

1Source sends the broad process environment to a literal external destination. L1: import { execSync, spawn, spawnSync } from "child_process"; L2: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, renameSync } from "fs"; ... L29: function currentWorkspaceLedgerDb() { L30: return path.join(workspaceStoreDir(process.cwd()), "action-ledger.db"); L31: } ... L85: const { cfg } = await import("../config/config.js"); L86: const apiUrl = (cfg("MERGEN_API_URL").value ?? "https://api.mergen.app").replace(/\/+$/, ""); L87: await enrollRuntimeCredential(apiUrl, licenseKey, getInstallId(), process.platform); L88: } catch { ... L107: } L108: const apiUrl = process.env.MERGEN_API_URL ?? "https://api.mergen.app"; L109: console.log("\u{1F680} Signing in to Mergen...\n");

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/commands/setup.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/commands/setup.js: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, renameSync } from "fs"; const { runDeviceAuthorization, DeviceAuthError } = await import("../intelligence/device-auth.js"); const activation = await runDeviceAuthorization(apiUrl, { writeFileSync(terminalModeFile, `${(/* @__PURE__ */ new Date()).toISOString()} writeFileSync(SECRET_FILE, secret, { encoding: "utf8", mode: 384 }); const { createInterface: createInterface2 } = await import("readline"); writeFileSync(tmp, next, { encoding: "utf8", mode: 384 }); writeFileSync(envPath, `${existing}${existing.endsWith("\n") || existing === "" ? "" : "\

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/commands/setup.js

dist/intelligence/shadow-digest-cron.jsView file

2import logger from "../sensor/logger.js"; L3: const SYSTEM_TENANT = process.env.MERGEN_SYSTEM_TENANT_ID; L4: const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3; ... L28: try { L29: const res = await fetch("https://slack.com/api/chat.postMessage", { L30: method: "POST", ... L34: }, L35: body: JSON.stringify({ channel, blocks }) L36: }); ... L40: } L41: const json = await res.json(); L42: if (!json.ok) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/intelligence/shadow-digest-cron.jsView on unpkg · L2

2Trigger-reachable chain: scripts.start -> dist/index.js -> dist/intelligence/shadow-digest-cron.js L2: import logger from "../sensor/logger.js"; L3: const SYSTEM_TENANT = process.env.MERGEN_SYSTEM_TENANT_ID; L4: const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3; ... L28: try { L29: const res = await fetch("https://slack.com/api/chat.postMessage", { L30: method: "POST", ... L34: }, L35: body: JSON.stringify({ channel, blocks }) L36: }); ... L40: } L41: const json = await res.json(); L42: if (!json.ok) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/intelligence/shadow-digest-cron.jsView on unpkg · L2

2Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/intelligence/shadow-digest-cron.js L2: import logger from "../sensor/logger.js"; L3: const SYSTEM_TENANT = process.env.MERGEN_SYSTEM_TENANT_ID; L4: const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3; ... L28: try { L29: const res = await fetch("https://slack.com/api/chat.postMessage", { L30: method: "POST", ... L34: }, L35: body: JSON.stringify({ channel, blocks }) L36: }); ... L40: } L41: const json = await res.json(); L42: if (!json.ok) {

dist/routes/device-auth-stub.jsView file

•Manifest-reachable source serializes caller or host-sensitive data to a package-embedded authenticated webhook. dist/routes/device-auth-stub.js: webhookUrl: `https://discord.[redacted]-${randomBytes(8).toString("hex")}`, var r=await fetch('/v1/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})}); var r=await fetch('/v1/github/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})}); var r=await fetch('/v1/slack/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})}); var r=await fetch('/v1/${id}/device/approve',{method:'POST',headers:{'content-type':'application/json

High

Fixed Authenticated Webhook Data Exfiltration

Manifest-reachable source sends caller or host-sensitive data to a package-embedded authenticated webhook.

dist/routes/device-auth-stub.jsView on unpkg

dist/intelligence/enterprise-policy-engine.jsView file

3import os from "os"; L4: import { execFileSync } from "child_process"; L5: import { createHash, createHmac, randomUUID, timingSafeEqual } from "crypto"; ... L224: "gnupg", L225: // ' .env' catches a cwd-relative `cat .env`; '/.env' catches a path- L226: // qualified reference (`cat ~/.env`, `cat some/dir/.env`) that the ... L282: function _allowUnsignedPolicy() { L283: return process.env.MERGEN_ALLOW_UNSIGNED_POLICY === "true"; L284: } ... L316: const expected = _signPolicyPayload(raw, secret); L317: const storedBuf = Buffer.from(storedSig, "hex"); L318: const expectBuf = Buffer.from(expected, "hex");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/intelligence/enterprise-policy-engine.jsView on unpkg · L3

dist/commands/incident.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/incident.js#virtual:normalized:round1View on unpkg

Source & flagged code

21 flagged

dist/commands/connect.jsView file

Lines 267-307javascript

267 }

268 } catch (err) {

269 console.log(`\u2717 (${err instanceof Error ? err.message : "network error"})`);

270 }

271 const teamId = (await ask(" Default team ID (Enter to pass per-request): ")).trim();

272 persistOrPrint({ LINEAR_API_KEY: apiKey, LINEAR_TEAM_ID: teamId });

273}

274async function connectEmail() {

275 console.log("");

276 log("Email connect \u2014 daily digest + weekly impact report by email", "\u2139");

277 console.log(" Email is a low-urgency digest sink. HITL approvals are NEVER delivered");

278 console.log(" by email (holds auto-deny after 15 min \u2014 use Slack for approvals).");

279 console.log("");

280 const host = (await ask(" SMTP host (smtp.yourco.com): ")).trim();

281 if (!host) {

282 log("No host entered \u2014 skipped.", "\u2139");

283 return;

284 }

285 const port = (await ask(" SMTP port (Enter for 587): ")).trim() || "587";

286 const user = (await ask(" SMTP username (Enter if none): ")).trim();

287 const pass = user ? (await ask(" SMTP password: ")).trim() : "";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/connect.jsView on unpkg · L287

288 const from = (await ask(" From address (Mergen <mergen@yourco.com>): ")).trim();

289 const to = (await ask(" Recipients, comma-separated: ")).trim();

290 if (!from || !to) {

291 log("From and recipients are required \u2014 skipped.", "\u2139");

292 return;

293 }

294 process.stdout.write(" Verifying SMTP connection... ");

295 try {

296 const { default: nodemailer } = await import("nodemailer");

297 const transporter = nodemailer.createTransport({

298 host,

299 port: Number(port),

300 secure: Number(port) === 465,

301 ...user ? { auth: { user, pass } } : {},

302 connectionTimeout: 8e3

303 });

304 await transporter.verify();

305 console.log("\u2713");

306 } catch (err) {

307 console.log(`\u2717 (${err instanceof Error ? err.message : "connection error"})`);

dist/intelligence/git-adr-sync.jsView file

Lines 1-21javascript

1import { execSync } from "child_process";

2import fs from "fs";

High

Child Process

Package source references child process execution.

dist/intelligence/git-adr-sync.jsView on unpkg · L1

3import path from "path";

4

dist/intelligence/process-tree.jsView file

Lines 1-37javascript

1import { execFile } from "child_process";

2import { promisify } from "util";

3import logger from "../sensor/logger.js";

4const execFileAsync =

dist/intelligence/execution-mode.jsView file

Lines 1-38javascript

1function isAutopilotEnabled() {

2 return process.env.MERGEN_AUTOPILOT === "true";

3}

4function isShadowMode() {

5 const shadowEnv

dist/commands/service.jsView file

Lines 1-21javascript

1import { execFileSync } from "child_process";

2import { existsSync, mkdirSync, unlinkSync, writeFileSync } from "fs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/service.jsView on unpkg · L1

3import { homedir } from "os";

dist/commands/incident.jsView file

Lines 130-170javascript

130 const command = rest[0];

131 const cmdArgs = rest.slice(1);

132 const processName =

dist/commands/setup.jsView file

Lines 1-21javascript

1import { execSync, spawn, spawnSync } from "child_process";

2import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, renameSync } from "fs";

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/commands/setup.jsView on unpkg · L1

3import { randomUUID } from "crypto";

dist/intelligence/shadow-digest-cron.jsView file

Lines 1-22javascript

1import { getStores } from "../storage/store-registry.js";

2import logger from "../sensor/logger.js";

3const SYSTEM_TENANT = process.env.MERGEN_SYSTEM_TENANT_ID;

4const SEVEN_DAYS_MS

dist/routes/device-auth-stub.jsView file

•Manifest-reachable source serializes caller or host-sensitive data to a package-embedded authenticated webhook. dist/routes/device-auth-stub.js: webhookUrl: `https://discord.[redacted]-${randomBytes(8).toString("hex")}`, var r=await fetch('/v1/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})}); var r=await fetch('/v1/github/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})}); var r=await fetch('/v1/slack/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})}); var r=await fetch('/v1/${id}/device/approve',{method:'POST',headers:{'content-type':'application/json

High

Fixed Authenticated Webhook Data Exfiltration

Manifest-reachable source sends caller or host-sensitive data to a package-embedded authenticated webhook.

dist/routes/device-auth-stub.jsView on unpkg

dist/intelligence/enterprise-policy-engine.jsView file

3import os from "os"; L4: import { execFileSync } from "child_process"; L5: import { createHash, createHmac, randomUUID, timingSafeEqual } from "crypto"; ... L224: "gnupg", L225: // ' .env' catches a cwd-relative `cat .env`; '/.env' catches a path- L226: // qualified reference (`cat ~/.env`, `cat some/dir/.env`) that the ... L282: function _allowUnsignedPolicy() { L283: return process.env.MERGEN_ALLOW_UNSIGNED_POLICY === "true"; L284: } ... L316: const expected = _signPolicyPayload(raw, secret); L317: const storedBuf = Buffer.from(storedSig, "hex"); L318: const expectBuf = Buffer.from(expected, "hex");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/intelligence/enterprise-policy-engine.jsView on unpkg · L3

dist/commands/incident.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/incident.js#virtual:normalized:round1View on unpkg