Loading npm security reports…

pgautopilot@2.2.2: AI-agent control-surface risk | LPM Firewall

registry / pgautopilot / 2.2.2

pgautopilot@2.2.2

PGAutoPilot — an MCP server that lets AI assistants safely explore, query, and manage any PostgreSQL database. Zero setup, auto-discovery, production-safe.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the consuming project's AI-client configuration files. It also modifies an existing user-level Claude Desktop configuration to register an MCP server that runs pgautopilot.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs postinstall.

Impact

AI clients can subsequently launch the package without an explicit configuration command from the user.

Mechanism

Automatic installation-time registration of an MCP command in project and user AI-client configuration.

Policy narrative

The package declares a postinstall hook. That hook walks out of node_modules to the consuming project, creates or merges configuration for many AI clients, and registers commands that launch pgautopilot. If a Claude Desktop configuration already exists in the user's home directory, it also merges an MCP entry there. These mutations occur during installation rather than through an explicit setup command.

Rationale

This is an unconsented postinstall mutation of both a consumer project and an existing user-level AI-agent control surface. The automatic registration is concrete and sufficient for a publish block under the install-control-surface policy.

Evidence

package.jsonscripts/postinstall.mjsconfig/cursor/mcp.jsonconfig/codex/config.tomlconfig/claude/mcp.json$HOME/Library/Application Support/Claude/claude_desktop_config.json$HOME/.config/Claude/claude_desktop_config.json

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pgautopilot.bundle.cjsView file

46908// dist/toolHandlers.js L46909: var import_node_child_process = require("node:child_process"); L46910: var import_fs2 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L46908

2948sourceCode = this.opts.code.process(sourceCode, sch); L2949: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2950: const validate2 = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pgautopilot.bundle.cjsView on unpkg · L2948

1232// validation function arguments L1233: data: new codegen_1.Name("data"), L1234: // data passed to validation function ... L2259: id = normalizeId(id); L2260: return resolver.resolve(baseId, id); L2261: } ... L3122: for (i = 0; i < input2.length; i++) { L3123: code = input2[i].charCodeAt(0); L3124: if (code === 48) { ... L13346: if (!isUTC) { L13347: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4); L13348: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/pgautopilot.bundle.cjsView on unpkg · L1232

scripts/postinstall.mjsView file

1import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; L2: import { resolve, dirname, join } from "path"; ... L17: rel: "cursor/mcp.json", L18: key: "mcpServers", L19: entry: { ...PG_ENTRY }, ... L27: rel: "windsurf/mcp_config.json", L28: key: "mcpServers", L29: entry: { ...PG_ENTRY }, ... L32: rel: "claude/mcp.json", L33: key: "mcpServers", L34: entry: { command: "pgautopilot" }, ... L36: {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

scripts/bundle.mjsView file

5Cross-file remote execution chain: scripts/bundle.mjs spawns dist/pgautopilot.bundle.cjs; helper contains network access plus dynamic code execution. L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)); L7: const root = resolve(__dirname, ".."); ... L14: L15: const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8")); L16: ... L54: L55: const { execSync } = await import("child_process"); L56: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/bundle.mjsView on unpkg · L5

uninstall.ps1View file

•path = uninstall.ps1 kind = build_helper sizeBytes = 1560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.ps1View on unpkg

install.shView file

•matchType = normalized_sha256 matchedPackage = pgautopilot@2.1.0 matchedPath = install.sh matchedIdentity = npm:cGdhdXRvcGlsb3Q:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.shView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "pgautopilot",

3 "version": "2.2.2",

4 "type": "module",

5 "description": "PGAutoPilot — an MCP server that lets AI assistants safely explore, query, and manage any PostgreSQL database. Zero setup, auto-discovery, production-safe.",

6 "main": "dist/index.js",

7 "bin": {

8 "pgautopilot": "dist/pgautopilot.bundle.cjs"

9 },

10 "scripts": {

11 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "build": "tsc -p tsconfig.build.json",

13 "postbuild": "node scripts/bundle.mjs",

14 "bundle": "node scripts/bundle.mjs",

15 "sign": "node scripts/sign.mjs",

16 "sign:gpg": "node scripts/sign.mjs --gpg",

17 "verify": "node scripts/verify.mjs",

18 "verify:gpg": "node scripts/verify.mjs --gpg",

19 "security": "npm audit --omit=dev --audit-level=high",

20 "start": "node dist/index.js",

21 "start:bundle": "node dist/pgautopilot.bundle.cjs",

22 "dev": "tsx src/index.ts",

23 "typecheck": "tsc -p tsconfig.json",

24 "lint": "tsc -p tsconfig.json && eslint src tests",

25 "test": "vitest run --dir tests",

26 "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",

27 "prepublishOnly": "npm run build"

28 },

29 "keywords": [

30 "mcp",

31 "mcp-server",

dist/pgautopilot.bundle.cjsView file

46908// dist/toolHandlers.js L46909: var import_node_child_process = require("node:child_process"); L46910: var import_fs2 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L46908

2948sourceCode = this.opts.code.process(sourceCode, sch); L2949: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2950: const validate2 = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pgautopilot.bundle.cjsView on unpkg · L2948

1232// validation function arguments L1233: data: new codegen_1.Name("data"), L1234: // data passed to validation function ... L2259: id = normalizeId(id); L2260: return resolver.resolve(baseId, id); L2261: } ... L3122: for (i = 0; i < input2.length; i++) { L3123: code = input2[i].charCodeAt(0); L3124: if (code === 48) { ... L13346: if (!isUTC) { L13347: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4); L13348: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/pgautopilot.bundle.cjsView on unpkg · L1232

scripts/postinstall.mjsView file

Lines 1-21javascript

1import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

2import { resolve, dirname, join } from "path";

3import { homedir, platform } from "os";

4import { fileURLToPath } from "url";

scripts/bundle.mjsView file

Lines 1-25javascript

1import * as esbuild from "esbuild";

2import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";

3import { resolve, dirname } from "path";

4import { fileURLToPath }

uninstall.ps1View file

•path = uninstall.ps1 kind = build_helper sizeBytes = 1560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.ps1View on unpkg

install.shView file

•matchType = normalized_sha256 matchedPackage = pgautopilot@2.1.0 matchedPath = install.sh matchedIdentity = npm:cGdhdXRvcGlsb3Q:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.shView on unpkg