registry / pgautopilot / 2.0.1

pgautopilot@2.0.1

⚠ Under review

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 688 KB of source, external domains: json-schema.org, www.postgresql.org

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pgautopilot.bundle.cjsView file

16600// dist/toolHandlers.js L16601: var import_node_child_process = require("node:child_process"); L16602: var import_fs2 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L16600

349"use strict"; L350: var bufferFrom = Buffer.from || Buffer; L351: module2.exports = function parseBytea(input) { ... L769: if (!isUTC) { L770: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4); L771: } ... L978: // database user's name L979: user: process.platform === "win32" ? process.env.USERNAME : process.env.USER, L980: // name of database to connect ... L994: binary: false, L995: // Connection pool options - see https://github.com/brianc/node-pg-pool L996: // number of connections to use in connection pool

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/pgautopilot.bundle.cjsView on unpkg · L349

scripts/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { existsSync, mkdirSync, writeFileSync } from "fs"; L3: import { resolve, dirname } from "path"; ... L29: ".cursor/mcp.json": { L30: mcpServers: { L31: pgautopilot: { command: "npx", args: ["pgautopilot"] }, ... L43: ".codeium/windsurf/mcp_config.json": { L44: mcpServers: { L45: pgautopilot: { command: "npx", args: ["pgautopilot"] }, ... L58: } L59: mkdirSync(dirname(filePath), { recursive: true }); L60: writeFileSync(filePath, JSON.stringify(content, null, 2) + "\n"); Payload evidence from .claude/README.md: L1: # Claude Desktop L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

scripts/bundle.mjsView file

5Cross-file remote execution chain: scripts/bundle.mjs spawns dist/pgautopilot.bundle.cjs; helper contains network access plus dynamic code execution. L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)); L7: const root = resolve(__dirname, ".."); ... L14: L15: const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8")); L16: ... L54: L55: const { execSync } = await import("child_process"); L56: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/bundle.mjsView on unpkg · L5

uninstall.ps1View file

•path = uninstall.ps1 kind = build_helper sizeBytes = 1560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.ps1View on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pgautopilot.bundle.cjsView file

16600// dist/toolHandlers.js L16601: var import_node_child_process = require("node:child_process"); L16602: var import_fs2 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L16600

Findings

1 Critical4 High4 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/pgautopilot.bundle.cjs

HighShell

HighCross File Remote Execution Contextscripts/bundle.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperuninstall.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/pgautopilot.bundle.cjs

LowFilesystem

LowHigh Entropy Strings