Loading npm security reports…

pgautopilot@2.1.0: AI-agent control-surface risk | LPM Firewall

registry / pgautopilot / 2.1.0

pgautopilot@2.1.0

PGAutoPilot — an MCP server that lets AI assistants safely explore, query, and manage any PostgreSQL database. Zero setup, auto-discovery, production-safe.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the consuming project’s Cursor, VS Code, and Windsurf MCP configuration. On a later editor launch, those clients can start the package through npx; its server reads the project .env DATABASE_URL.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation followed by opening the project in a supported editor

Impact

Adds an AI-agent tool and automatic execution path to foreign project/editor control surfaces, with access to the configured database connection.

Mechanism

unconsented install-time editor MCP configuration injection

Policy narrative

Installing the package invokes postinstall. The hook walks out of node_modules to the consumer project and creates missing MCP configuration for multiple editors, registering an npx pgautopilot command. This is an unconsented mutation of broad, foreign AI-agent control surfaces. When an editor subsequently loads the project, it can launch the MCP server, which reads the project working directory’s .env DATABASE_URL and exposes database-management tools to the editor’s AI client.

Rationale

The postinstall hook concretely injects MCP launch configuration into multiple third-party editor directories under the consumer project. This meets the install-time foreign/broad AI-agent control-surface block policy even without separate exfiltration code.

Evidence

package.jsonscripts/postinstall.mjssrc/index.ts.cursor/mcp.json.vscode/mcp.json.codeium/windsurf/mcp_config.json.env.example.env

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pgautopilot.bundle.cjsView file

16612// dist/toolHandlers.js L16613: var import_node_child_process = require("node:child_process"); L16614: var import_fs2 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L16612

349"use strict"; L350: var bufferFrom = Buffer.from || Buffer; L351: module2.exports = function parseBytea(input) { ... L769: if (!isUTC) { L770: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4); L771: } ... L978: // database user's name L979: user: process.platform === "win32" ? process.env.USERNAME : process.env.USER, L980: // name of database to connect ... L994: binary: false, L995: // Connection pool options - see https://github.com/brianc/node-pg-pool L996: // number of connections to use in connection pool

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/pgautopilot.bundle.cjsView on unpkg · L349

scripts/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { existsSync, mkdirSync, writeFileSync } from "fs"; L3: import { resolve, dirname } from "path"; ... L29: ".cursor/mcp.json": { L30: mcpServers: { L31: pgautopilot: { command: "npx", args: ["pgautopilot"] }, ... L43: ".codeium/windsurf/mcp_config.json": { L44: mcpServers: { L45: pgautopilot: { command: "npx", args: ["pgautopilot"] }, ... L58: } L59: mkdirSync(dirname(filePath), { recursive: true }); L60: writeFileSync(filePath, JSON.stringify(content, null, 2) + "\n"); Payload evidence from .claude/README.md: L1: # Claude Desktop L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

scripts/bundle.mjsView file

5Cross-file remote execution chain: scripts/bundle.mjs spawns dist/pgautopilot.bundle.cjs; helper contains network access plus dynamic code execution. L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)); L7: const root = resolve(__dirname, ".."); ... L14: L15: const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8")); L16: ... L54: L55: const { execSync } = await import("child_process"); L56: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/bundle.mjsView on unpkg · L5

uninstall.ps1View file

•path = uninstall.ps1 kind = build_helper sizeBytes = 1560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.ps1View on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "pgautopilot",

3 "version": "2.1.0",

4 "type": "module",

5 "description": "PGAutoPilot — an MCP server that lets AI assistants safely explore, query, and manage any PostgreSQL database. Zero setup, auto-discovery, production-safe.",

6 "main": "dist/index.js",

7 "bin": {

8 "pgautopilot": "dist/pgautopilot.bundle.cjs"

9 },

10 "scripts": {

11 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "build": "tsc -p tsconfig.build.json",

13 "postbuild": "node scripts/bundle.mjs",

14 "bundle": "node scripts/bundle.mjs",

15 "sign": "node scripts/sign.mjs",

16 "sign:gpg": "node scripts/sign.mjs --gpg",

17 "verify": "node scripts/verify.mjs",

18 "verify:gpg": "node scripts/verify.mjs --gpg",

19 "start": "node dist/index.js",

20 "start:bundle": "node dist/pgautopilot.bundle.cjs",

21 "dev": "tsx src/index.ts",

22 "typecheck": "tsc -p tsconfig.json",

23 "lint": "tsc -p tsconfig.json && eslint src tests",

24 "test": "vitest run --dir tests",

25 "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",

26 "prepublishOnly": "npm run build"

27 },

28 "keywords": [

29 "mcp",

30 "mcp-server",

31 "model-context-protocol",

dist/pgautopilot.bundle.cjsView file

16612// dist/toolHandlers.js L16613: var import_node_child_process = require("node:child_process"); L16614: var import_fs2 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L16612

349"use strict"; L350: var bufferFrom = Buffer.from || Buffer; L351: module2.exports = function parseBytea(input) { ... L769: if (!isUTC) { L770: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4); L771: } ... L978: // database user's name L979: user: process.platform === "win32" ? process.env.USERNAME : process.env.USER, L980: // name of database to connect ... L994: binary: false, L995: // Connection pool options - see https://github.com/brianc/node-pg-pool L996: // number of connections to use in connection pool

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/pgautopilot.bundle.cjsView on unpkg · L349

scripts/postinstall.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, writeFileSync } from "fs";

3import { resolve, dirname } from "path";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

4import { fileURLToPath } from

scripts/bundle.mjsView file

Lines 1-25javascript

1import * as esbuild from "esbuild";

2import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";

3import { resolve, dirname } from "path";

4import { fileURLToPath }

uninstall.ps1View file

•path = uninstall.ps1 kind = build_helper sizeBytes = 1560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.ps1View on unpkg