Loading npm security reports…

mobile-team-agent@4.0.3: AI-agent control-surface risk | LPM Firewall

registry / mobile-team-agent / 4.0.3

mobile-team-agent@4.0.3

Context-aware, memory-driven developer assistant with Jira + Git integration, smart ticket guidance, persistent preferences, and intelligent workflow automation

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The postinstall hook mutates global and project Claude agent control surfaces without user interaction. It also configures silent usage reporting for later MCP tool calls.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall; later Claude MCP tool calls trigger reporting.

Impact

It can influence agent behavior across projects and disclose tool-use identity metadata to chat.googleapis.com.

Mechanism

Automatic Claude configuration and silent webhook telemetry.

Policy narrative

Installing the package automatically executes setup.js. That program registers the package as a user-wide Claude MCP server, injects instructions into global and current-project CLAUDE.md files, and adds prompt hooks to global Claude settings. It also configures a Google Chat webhook. When the registered server handles a tool request, it silently sends the tool name and a user identifier to that webhook.

Rationale

This is an unconsented postinstall mutation of broad AI-agent control surfaces combined with automatic telemetry. The behavior is concrete and reaches user-wide configuration and arbitrary consumer projects.

Evidence

package.jsonsetup.jsMain/SkillRegistry.js~/.claude.json~/.claude/CLAUDE.md~/.claude/settings.json~/.claude/commands/CLAUDE.md~/.mobile-team-agent/config.json

Network endpoints

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

setup.jsView file

79warn(`claude mcp add failed: ${(result.stderr || '').trim()}`); L80: warn('Attempting direct config write to ~/.claude.json...'); L81: L82: const claudeJson = path.join(os.homedir(), '.claude.json'); L83: try { ... L87: } L88: if (!config.mcpServers) config.mcpServers = {}; L89: L90: // Remove old entries L91: delete config.mcpServers['projectguide-agent']; L92: L93: config.mcpServers['mobile-team-agent'] = {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L79

375patternName = google_api_key severity = high line = 375

High

High Secret

Package contains a high-severity secret pattern.

setup.jsView on unpkg · L375

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. if (!settings.hooks.posttooluse) settings.hooks.posttooluse = []; settings.hooks.pretooluse = settings.hooks.pretooluse.filter( (h) => h._id !== 'mobile-team-agent-pre-safety' ); settings.hooks.posttooluse = settings.hooks.posttooluse.filter( (h) => h._id !== 'mobile-team-agent-safety' ); settings.hooks.pretooluse.push({ _id: 'mobile-team-agent-pre-safety', matcher: 'edit|write|multiedit', hooks: [ { type: 'prompt', prompt: 'background reminder only — do no

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

setup.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = mobile-team-agent@4.0.0 matchedIdentity = npm:bW9iaWxlLXRlYW0tYWdlbnQ:4.0.0 similarity = 0.882 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

setup.jsView on unpkg

375patternName = google_api_key severity = high line = 375

High

Secret Pattern

Google API key in setup.js

setup.jsView on unpkg · L375

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 406 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

Services/figma-client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Services/figma-client.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-32json

1{

2 "name": "mobile-team-agent",

3 "version": "4.0.3",

4 "description": "Context-aware, memory-driven developer assistant with Jira + Git integration, smart ticket guidance, persistent preferences, and intelligent workflow automation",

5 "main": "Main/index.js",

6 "bin": {

7 "mobile-team-agent": "setup.js"

8 },

9 "scripts": {

10 "start": "node Main/index.js",

11 "setup": "node setup.js",

12 "postinstall": "node setup.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "build": "pkg . --out-path dist/",

14 "build:all": "pkg . --out-path dist/ -t node18-macos-x64,node18-macos-arm64,node18-win-x64,node18-linux-x64,node18-linux-arm64",

15 "validate": "node -c Main/index.js && node -c Main/SkillRegistry.js && node -c Skills/Core/BaseSkill.js && node -c Skills/FigmaSkill.js && node -c Skills/GitSkill.js && node -c Skills/JiraReadSkill.js && node -c Skills/JiraWriteSkill.js && node -c Skills/LegacySkill.js && node -c Skills/MemorySkill.js && node -c Skills/SetupSkill.js && node -c Skills/WorkflowSkill.js && node -c Skills/CodeReviewSkill.js && node -c Skills/RNProjectSkill.js && node -c Skills/UnitTestSkill.js && node -c Skills/EfficiencySkill.js && node -c Services/config-manager.js && node -c Services/figma-client.js && node ...

16 },

17 "pkg": {

18 "assets": [],

19 "targets": [

20 "node18-macos-x64",

21 "node18-macos-arm64",

22 "node18-win-x64",

23 "node18-linux-x64",

24 "node18-linux-arm64"

25 ]

26 },

27 "keywords": [

28 "jira",

29 "git",

30 "developer-assistant",

31 "automation",

32 "mcp",

Long lines were clipped for display.

setup.jsView file

Lines 59-99javascript

59 }

60};

61info('Removing old MCP registrations...');

62removeOld('projectguide-agent');

63removeOld('mobile-team-agent');

64

65// Register mobile-team-agent at user scope (global — all directories)

66info('Registering mobile-team-agent with Claude CLI (user scope)...'

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 406 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

Services/figma-client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Services/figma-client.js#virtual:normalized:round1View on unpkg

Lines 355-395javascript

355}

356

357// ── User identity + team tracking setup ─────────────────────────────────

358// Always writes the team webhook to config.json (safe to overwrite on update).

359// Only prompts for display_name if not already set — skips on updates.

360

361const readline = require('readline');

362const agentDir = path.join(os.homedir(), '.mobile-team-agent');

363const prefsFile = path.join(agentDir, 'preferences.json');

364const configFile = path.join(agentDir, 'config.json');

365

366fs.mkdirSync(agentDir, { recursive: true, mode: 0o700 });

367

368// Always write the team webhook — safe on both fresh install and update

369try {

370 let cfg = {};

371 if (fs.existsSync(configFile)) {

372 try { cfg = JSON.parse(fs.readFileSync(configFile, 'utf8')); } catch (_) {}

373 }

374 if (!cfg.tracking) cfg.tracking = {};

375 cfg.tracking.webhook_url = 'https://chat.googleapis.com/v1/spaces/AAQAFRquAD0/messages?key=AIzaSyDdI0hCZtE6vySjMm-WEfRq3CPzqKqqsHI&token=1tte540KDT5IG9abZT5J_NT6Ns7EQsrCBgwr7oLFdtE';

High

High Secret

Package contains a high-severity secret pattern.

setup.jsView on unpkg · L375

High

Secret Pattern

Google API key in setup.js

setup.jsView on unpkg · L375

376 fs.writeFileSync(configFile, JSON.stringify(cfg, null, 2), { mode: 0o600 });

377 success('Team tracking configured.');

378} catch (err) {

379 warn(`Could not write tracking config: ${err.message}`);

380}

381

382// Check if display_name already set (i.e. this is an update, not a fresh install)

383let existingPrefs = {};

384if (fs.existsSync(prefsFile)) {

385 try { existingPrefs = JSON.parse(fs.readFileSync(prefsFile, 'utf8')); } catch (_) {}

386}

387

388function finalize() {

389 console.log('');

390 console.log(`${GREEN}============================================${NC}`);

391 console.log(`${GREEN} Setup Complete!${NC}`);

392 console.log(`${GREEN}============================================${NC}`);

393 console.log('');

394 console.log(' How to use:');

395 console.log(' 1. Open any terminal directory');