Loading npm security reports…

pgautopilot@2.4.0: AI-agent control-surface risk | LPM Firewall

registry / pgautopilot / 2.4.0

pgautopilot@2.4.0

PGAutoPilot — an MCP server that lets AI assistants safely explore, query, and manage any PostgreSQL database. Zero setup, auto-discovery, production-safe.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation automatically adds a runnable pgautopilot MCP server to numerous AI-client configurations. It also changes an existing Claude Desktop configuration and project skill lock files.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm runs postinstall.

Impact

A package install can cause AI clients in the consumer project or user profile to launch pgautopilot without an explicit setup command.

Mechanism

Automatic AI-agent configuration and skill-lock mutation.

Policy narrative

On npm installation, package.json invokes scripts/postinstall.mjs. That script adds pgautopilot MCP launch entries for many AI tools, writes a Codex configuration, and changes an existing Claude Desktop configuration in the user profile. It then executes merge-skills-lock.mjs against the consumer project, which modifies an existing skill lock or creates one. These changes occur without an explicit user setup command and create persistent AI-agent launch and capability configuration.

AI rationale

This is unconsented postinstall mutation of foreign AI-agent control surfaces and project skill metadata. The automatic lifecycle behavior is sufficient for a publish block even though no data exfiltration was found in the inspected code.

Evidence

package.jsonscripts/postinstall.mjsscripts/merge-skills-lock.mjsconfig/cursor/mcp.jsonconfig/vscode/mcp.jsonconfig/codex/config.tomlconfig/claude/mcp.json

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pgautopilot.bundle.cjsView file

47550// dist/toolHandlers.js L47551: var import_node_child_process = require("node:child_process"); L47552: var import_fs3 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L47550

1232// validation function arguments L1233: data: new codegen_1.Name("data"), L1234: // data passed to validation function ... L2259: id = normalizeId(id); L2260: return resolver.resolve(baseId, id); L2261: } ... L3122: for (i = 0; i < input2.length; i++) { L3123: code = input2[i].charCodeAt(0); L3124: if (code === 48) { ... L13346: if (!isUTC) { L13347: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4); L13348: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/pgautopilot.bundle.cjsView on unpkg · L1232

•matchType = normalized_sha256 matchedPackage = pgautopilot@2.2.2 matchedPath = dist/pgautopilot.bundle.cjs matchedIdentity = npm:cGdhdXRvcGlsb3Q:2.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pgautopilot.bundle.cjsView on unpkg

2948sourceCode = this.opts.code.process(sourceCode, sch); L2949: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2950: const validate2 = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pgautopilot.bundle.cjsView on unpkg · L2948

1232// validation function arguments L1233: data: new codegen_1.Name("data"), L1234: // data passed to validation function ... L2259: id = normalizeId(id); L2260: return resolver.resolve(baseId, id); L2261: } ... L3122: for (i = 0; i < input2.length; i++) { L3123: code = input2[i].charCodeAt(0); L3124: if (code === 48) { ... L13346: if (!isUTC) { L13347: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4); L13348: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/pgautopilot.bundle.cjsView on unpkg · L1232

scripts/postinstall.mjsView file

1import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; L2: import { resolve, dirname, join } from "path"; ... L26: rel: "cursor/mcp.json", L27: key: "mcpServers", L28: entry: { ...PG_ENTRY }, ... L36: rel: "windsurf/mcp_config.json", L37: key: "mcpServers", L38: entry: { ...PG_ENTRY }, ... L41: rel: "claude/mcp.json", L42: key: "mcpServers", L43: entry: { command: "pgautopilot" }, ... L45: {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

scripts/bundle.mjsView file

5Cross-file remote execution chain: scripts/bundle.mjs spawns dist/pgautopilot.bundle.cjs; helper contains network access plus dynamic code execution. L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)); L7: const root = resolve(__dirname, ".."); ... L14: L15: const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8")); L16: ... L54: L55: const { execSync } = await import("child_process"); L56: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/bundle.mjsView on unpkg · L5

uninstall.ps1View file

•path = uninstall.ps1 kind = build_helper sizeBytes = 1560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.ps1View on unpkg

src/toolHandlers.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/toolHandlers.ts#virtual:normalized:round1View on unpkg

install.shView file

•matchType = normalized_sha256 matchedPackage = pgautopilot@2.2.2 matchedPath = install.sh matchedIdentity = npm:cGdhdXRvcGlsb3Q:2.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.shView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "pgautopilot",

3 "version": "2.4.0",

4 "type": "module",

5 "description": "PGAutoPilot — an MCP server that lets AI assistants safely explore, query, and manage any PostgreSQL database. Zero setup, auto-discovery, production-safe.",

6 "main": "dist/index.js",

7 "bin": {

8 "pgautopilot": "dist/pgautopilot.bundle.cjs"

9 },

10 "scripts": {

11 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "build": "tsc -p tsconfig.build.json",

13 "postbuild": "node scripts/bundle.mjs",

14 "bundle": "node scripts/bundle.mjs",

15 "sign": "node scripts/sign.mjs",

16 "sign:gpg": "node scripts/sign.mjs --gpg",

17 "verify": "node scripts/verify.mjs",

18 "verify:gpg": "node scripts/verify.mjs --gpg",

19 "security": "npm audit --omit=dev --audit-level=high",

20 "start": "node dist/index.js",

21 "start:bundle": "node dist/pgautopilot.bundle.cjs",

22 "dev": "tsx src/index.ts",

23 "typecheck": "tsc -p tsconfig.json",

24 "lint": "tsc -p tsconfig.json && eslint src tests",

25 "test": "vitest run --dir tests",

26 "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",

27 "prepublishOnly": "npm run build"

28 },

29 "keywords": [

30 "mcp",

31 "mcp-server",

dist/pgautopilot.bundle.cjsView file

47550// dist/toolHandlers.js L47551: var import_node_child_process = require("node:child_process"); L47552: var import_fs3 = require("fs");

High

Child Process

Package source references child process execution.

dist/pgautopilot.bundle.cjsView on unpkg · L47550

1232// validation function arguments L1233: data: new codegen_1.Name("data"), L1234: // data passed to validation function ... L2259: id = normalizeId(id); L2260: return resolver.resolve(baseId, id); L2261: } ... L3122: for (i = 0; i < input2.length; i++) { L3123: code = input2[i].charCodeAt(0); L3124: if (code === 48) { ... L13346: if (!isUTC) { L13347: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4); L13348: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/pgautopilot.bundle.cjsView on unpkg · L1232

•matchType = normalized_sha256 matchedPackage = pgautopilot@2.2.2 matchedPath = dist/pgautopilot.bundle.cjs matchedIdentity = npm:cGdhdXRvcGlsb3Q:2.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pgautopilot.bundle.cjsView on unpkg

scripts/postinstall.mjsView file

Lines 1-21javascript

1import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

2import { resolve, dirname, join } from "path";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

3import { homedir, platform } from "os";

scripts/bundle.mjsView file

Lines 1-25javascript

1import * as esbuild from "esbuild";

2import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";

3import { resolve, dirname } from "path";

4import { fileURLToPath }

uninstall.ps1View file

•path = uninstall.ps1 kind = build_helper sizeBytes = 1560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.ps1View on unpkg

src/toolHandlers.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/toolHandlers.ts#virtual:normalized:round1View on unpkg

install.shView file

•matchType = normalized_sha256 matchedPackage = pgautopilot@2.2.2 matchedPath = install.sh matchedIdentity = npm:cGdhdXRvcGlsb3Q:2.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.shView on unpkg