registry / pgautopilot / 2.1.2

pgautopilot@2.1.2

⚠ Under review

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 1.36 MB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.postgresql.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pgautopilot.bundle.cjsView file

35931// dist/toolHandlers.js L35932: var import_node_child_process = require("node:child_process"); L35933: var import_fs2 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L35931

2948sourceCode = this.opts.code.process(sourceCode, sch); L2949: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2950: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pgautopilot.bundle.cjsView on unpkg · L2948

1232// validation function arguments L1233: data: new codegen_1.Name("data"), L1234: // data passed to validation function ... L2259: id = normalizeId(id); L2260: return resolver.resolve(baseId, id); L2261: } ... L3122: for (i = 0; i < input.length; i++) { L3123: code = input[i].charCodeAt(0); L3124: if (code === 48) { ... L13346: if (!isUTC) { L13347: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4); L13348: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/pgautopilot.bundle.cjsView on unpkg · L1232

scripts/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { existsSync, mkdirSync, writeFileSync } from "fs"; L3: import { resolve, dirname } from "path"; ... L29: ".cursor/mcp.json": { L30: mcpServers: { L31: pgautopilot: { command: "npx", args: ["pgautopilot"] }, ... L43: ".codeium/windsurf/mcp_config.json": { L44: mcpServers: { L45: pgautopilot: { command: "npx", args: ["pgautopilot"] }, ... L58: } L59: mkdirSync(dirname(filePath), { recursive: true }); L60: writeFileSync(filePath, JSON.stringify(content, null, 2) + "\n"); Payload evidence from .claude/README.md: L1: # Claude Desktop L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

scripts/bundle.mjsView file

5Cross-file remote execution chain: scripts/bundle.mjs spawns dist/pgautopilot.bundle.cjs; helper contains network access plus dynamic code execution. L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)); L7: const root = resolve(__dirname, ".."); ... L14: L15: const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8")); L16: ... L54: L55: const { execSync } = await import("child_process"); L56: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/bundle.mjsView on unpkg · L5

uninstall.ps1View file

•path = uninstall.ps1 kind = build_helper sizeBytes = 1560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.ps1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pgautopilot.bundle.cjsView file

35931// dist/toolHandlers.js L35932: var import_node_child_process = require("node:child_process"); L35933: var import_fs2 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L35931

Findings

1 Critical4 High4 Medium7 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/pgautopilot.bundle.cjs

HighShell

HighCross File Remote Execution Contextscripts/bundle.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperuninstall.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/pgautopilot.bundle.cjs

LowWeak Cryptodist/pgautopilot.bundle.cjs

Low