Loading npm security reports…

overmind-mcp@3.9.0: AI-agent policy block | LPM Firewall

registry / overmind-mcp / 3.9.0

overmind-mcp@3.9.0

Orchestrateur universel agents IA multi-modeles via MCP. Inclut le protocole 'Custom-Nickname' pour identifier vos agents avec des surnoms originaux (The Chaos Prophet, Shadow Sniper, etc.), l'isolation mémoire (Private Memory Context) et le support pour

AI Security Review

scanned 5h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. On npm postinstall, the package rewires the pre-existing Hermes agent home to package-controlled storage. It preserves a backup but changes the active AI-agent configuration and imports credentials and skills without user confirmation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install when Docker is available

Impact

Foreign Hermes profiles, credentials, MCP configuration, skills, hooks, and sessions become active through ~/.overmind/hermes.

Mechanism

postinstall migration and symlink takeover of ~/.hermes

Policy narrative

The install hook executes without an explicit setup command. When Docker is present, it copies selected files and directories from the existing ~/.hermes agent home—including auth.json, .env, .mcp.json, skills, hooks, and sessions—into ~/.overmind/hermes, renames the original directory, and replaces ~/.hermes with a symlink to the package-controlled location. This is unconsented install-time mutation of a foreign AI-agent control surface.

Rationale

The package contains a concrete install-time takeover of an existing Hermes control surface, rather than merely an explicit user-invoked setup flow. That meets the blocking policy even though direct exfiltration was not found.

Evidence

package.jsonscripts/postinstall.mjs

Network endpoints2

raw.githubusercontent.com/DeamonDev888/overmind-mcp/main/.env.example/DeamonDev888/overmind-mcp/main/.mcp.json.example

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/launch.cjsView file

4L5: const { exec, spawn } = require("child_process"); L6: const fs = require("fs");

High

Child Process

Package source references child process execution.

bin/launch.cjsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = bin/launch.cjs matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/launch.cjsView on unpkg

dist/lib/InstallHelper.jsView file

2import { promisify } from 'util'; L3: const execAsync = promisify(exec); L4: export const CLIS_METADATA = {

High

Shell

Package source references shell execution.

dist/lib/InstallHelper.jsView on unpkg · L2

1import { exec } from 'child_process'; L2: import { promisify } from 'util'; ... L9: installCmd: 'npm install -g @anthropic-ai/claude-code', L10: url: 'https://www.npmjs.com/package/@anthropic-ai/claude-code', L11: }, ... L30: versionCmd: 'hermes --version', L31: installCmd: process.platform === 'win32' L32: ? 'powershell -Command "irm https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.ps1 | iex"' ... L82: try { L83: const { stdout } = await execAsync(meta.versionCmd); L84: const version = stdout.trim();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lib/InstallHelper.jsView on unpkg · L1

scripts/postinstall.mjsView file

10Install-time AI-agent control hijack evidence: L10: * - Copie .env.example → .env L11: * - Copie .mcp.json.example → .mcp.json L12: * ═══════════════════════════════════════════════════════════════════════════════ ... L17: existsSync, L18: mkdirSync, L19: writeFileSync, L20: readFileSync, ... L24: unlinkSync, L25: cpSync, L26: } from 'fs'; ... L249: L250: mkdirSync(INSTALL_DIR, { recursive: true }); Payload evidence from dist/services/AgentManager.js: L48: const content = await fs.readFile(mcpPath, 'utf-8'); L49: const json = JSON.parse(content); L50: return Object.keys(json.mcpServers || {}); ... L529: // Hermes profiles use their own .env per-profile — skip this requirement for runner=hermes L530: let authToken = process.env.ANTHROPIC_AUTH_TOKEN; L531: if (!authToken) { ... L553: ANTHRO

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L10

scripts/setup-windows.jsView file

55try { L56: const nodeVersion = execSync('node --version', { encoding: 'utf8' }).trim(); L57: console.log(`✅ Node.js: ${nodeVersion}`); ... L68: console.error('❌ pnpm non trouvé. Installez pnpm:'); L69: console.error(' npm install -g pnpm'); L70: return false;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/setup-windows.jsView on unpkg · L55

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = scripts/setup-windows.js matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/setup-windows.jsView on unpkg

bin/test_mcp.batView file

•path = bin/test_mcp.bat kind = build_helper sizeBytes = 170 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test_mcp.batView on unpkg

dist/services/KiloRunner.jsView file

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = dist/services/KiloRunner.js matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/KiloRunner.jsView on unpkg

scripts/test-installation.mjsView file

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = scripts/test-installation.mjs matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-installation.mjsView on unpkg

dist/services/ClineRunner.jsView file

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = dist/services/ClineRunner.js matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/ClineRunner.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 37-77json

37 "bin",

38 ".mcp.json.example"

39 ],

40 "scripts": {

41 "build": "tsc",

42 "rebuild": "rimraf dist && tsc",

43 "clean": "rimraf dist",

44 "start": "node --max-old-space-size=256 --no-warnings --env-file=.env dist/bin/cli.js",

45 "dev": "node --max-old-space-size=256 --no-warnings --watch --env-file=.env dist/bin/cli.js",

46 "build:fix": "pnpm run clean && pnpm install && pnpm run build",

47 "lint": "eslint .",

48 "lint:fix": "eslint . --fix",

49 "format": "prettier --write .",

50 "check-types": "tsc --noEmit",

51 "test": "vitest run",

52 "test:install": "node scripts/test-installation.mjs",

53 "changeset": "changeset",

54 "version": "changeset version && node scripts/auto-changelog.mjs",

55 "release": "pnpm run build && changeset publish",

56 "prepublishOnly": "pnpm run rebuild",

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "setup": "overmind-setup",

59 "setup:deps": "node scripts/install-dependencies.mjs",

60 "postgres:up": "overmind-postgres-mcp up",

61 "postgres:down": "overmind-postgres-mcp down",

62 "postgres:status": "overmind-postgres-mcp status",

63 "postgres:logs": "overmind-postgres-mcp logs",

64 "postgres:reset": "overmind-postgres-mcp reset",

65 "prebuild": "node -e \"try{require('fs').mkdirSync('dist/bin',{recursive:true});require('fs').copyFileSync('bin/launch.cjs','dist/bin/launch.cjs');console.log('Copied launch.cjs')}catch{console.log('dist/bin not ready yet')}\""

66 },

67 "keywords": [

68 "mcp",

69 "model-context-protocol",

70 "claude-code",

71 "ai-agent",

72 "llm",

73 "orchestration",

74 "automation",

75 "pgvector",

76 "docker",

77 "auto-installation"

bin/launch.cjsView file

Lines 1-24javascript

1process.title = "MCP-OVERMIND"; // [V16] Window identification

2// launch.js — compiled launcher for Workflow

3// Prebuild copies this to dist/bin/launch.js

4

5const { exec, spawn } = require("child_process");

6const

dist/lib/InstallHelper.jsView file

Lines 1-22javascript

1import { exec } from 'child_process';

2import { promisify } from 'util';

3const execAsync = promisify(exec);

4export const

scripts/postinstall.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * ═══════════════════════════════════════════════════════════════════════════════

4 * OVERMIND-MCP - POST-INSTALL AUTOMATIQUE (SIMPLIFIÉ)

5 * ═══════════════════════════════════════════════════════════════════════════════

6 * Script exécuté automatiquement après npm install -g overmind-mcp

7 * INSTALLE UNIQUEMENT :

8 * - Vérifie Docker

9 * - Installe PostgreSQL + pgvector (si absent)

10 * - Copie .env.example → .env

scripts/setup-windows.jsView file

Lines 35-75javascript

35 } catch (error) {

36 console.error(`❌ Erreur: ${error.message}`);

37 return false;

38 }

39}

40

41function

bin/test_mcp.batView file

•path = bin/test_mcp.bat kind = build_helper sizeBytes = 170 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test_mcp.batView on unpkg

dist/services/KiloRunner.jsView file

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = dist/services/KiloRunner.js matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/KiloRunner.jsView on unpkg

scripts/test-installation.mjsView file

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = scripts/test-installation.mjs matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-installation.mjsView on unpkg

dist/services/ClineRunner.jsView file

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = dist/services/ClineRunner.js matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/ClineRunner.jsView on unpkg