Loading npm security reports…

screenpipe-mcp@0.19.4: Malicious npm security report (Block) | LPM Firewall

registry / screenpipe-mcp / 0.19.4

screenpipe-mcp@0.19.4

MCP server for screenpipe - search your screen recordings and audio transcriptions

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Running the package binary invokes unpinned remote screenpipe code to obtain credentials. It can then use recovered credentials and create scheduled prompts through its MCP interface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Launching the stdio MCP server, or invoking its create-pipe tool.

Impact

A future screenpipe release can execute during package startup; local or enterprise credentials can be used in network requests and agent prompts can persist.

Mechanism

Automatic unpinned command execution, credential recovery, and scheduled prompt creation.

Attack narrative

On startup, the MCP server warms credential discovery without waiting for a tool call. The discovery path executes bun or npx with screenpipe@latest, allowing a newly published external package release to run in the user's environment. The package reads Screenpipe credentials and attaches them to API requests. Its reviewer-directed instruction also tells AI agents to edit files outside the package. The package exposes a tool that writes and enables scheduled prompts under the user's home directory.

Rationale

The package combines reviewer manipulation with automatic execution of unpinned remote code and credential handling. The lack of an npm install hook reduces scope but does not neutralize the startup execution chain.

Evidence

src/index.tssrc/team-config.tspackage.jsonsrc/telemetry.tsdist/cli.js~/.screenpipe/enterprise.json~/.screenpipe/pipes/<name>/pipe.md

Network endpoints1

Source & flagged code

12 flagged · loading source

dist/http-server.jsView file

35544exports2.execAsync = undefined; L35545: var child_process = require("child_process"); L35546: var util = require("util");

High

Child Process

Package source references child process execution.

dist/http-server.jsView on unpkg · L35544

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/http-server.js: // node_modules/zod/v4/core/core.js // node_modules/zod/v4/core/util.js // node_modules/zod/v4/core/errors.js // node_modules/zod/v4/core/parse.js // node_modules/zod/v4/core/regexes.js // node_modules/zod/v4/core/checks.js // node_modules/zod/v4/core/doc.js // node_modules/zod/v4/core/versions.js

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/http-server.jsView on unpkg

159Cross-file remote execution chain: dist/http-server.js spawns dist/index.js; helper contains network access plus dynamic code execution. L159: assignProp: () => assignProp, L160: base64ToUint8Array: () => base64ToUint8Array, L161: base64urlToUint8Array: () => base64urlToUint8Array, ... L924: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L925: } : { success: true, data: result.value }; L926: }, safeParse, _safeParseAsync = (_Err) => async (schema, value, _ctx) => { ... L1999: try { L2000: new URL(`http://[${payload.value}]`); L2001: } catch { ... L9152: id = normalizeId(id); L9153: return resolver.resolve(baseId, id); L9154: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/http-server.jsView on unpkg · L159

19926patternName = generic_password severity = medium line = 19926 matchedText = newUrl.p...d%";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/http-server.jsView on unpkg · L19926

dist/cli.jsView file

159assignProp: () => assignProp, L160: base64ToUint8Array: () => base64ToUint8Array, L161: base64urlToUint8Array: () => base64urlToUint8Array, ... L924: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L925: } : { success: true, data: result.value }; L926: }, safeParse, _safeParseAsync = (_Err) => async (schema, value, _ctx) => { ... L1999: try { L2000: new URL(`http://[${payload.value}]`); L2001: } catch { ... L9152: id = normalizeId(id); L9153: return resolver.resolve(baseId, id); L9154: }

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.jsView on unpkg · L159

51024Trigger-reachable chain: scripts.start -> dist/cli.js L51024: if (budgetLeft() > 0) { L51025: const { stdout } = await execAsync("npx screenpipe@latest auth token", { L51026: timeout: Math.min(PER_CANDIDATE_MS, budgetLeft()), ... L51033: } catch {} L51034: process.stderr.write([ L51035: "[screenpipe-mcp] could not discover SCREENPIPE_LOCAL_API_KEY from any source.", ... L51039: "Fix: set SCREENPIPE_LOCAL_API_KEY in your MCP launcher's env block,", L51040: "or install the screenpipe desktop app (https://screenpi.pe) so its CLI", L51041: "can resolve the key without bypassing Screenpipe's database boundary.",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L51024

9831sourceCode = this.opts.code.process(sourceCode, sch); L9832: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L9833: const validate = makeValidate(this, this.scope.get());

dist/index.jsView file

49628if (budgetLeft() > 0) { L49629: const { stdout } = await execAsync("npx screenpipe@latest auth token", { L49630: timeout: Math.min(PER_CANDIDATE_MS, budgetLeft()), ... L49637: } catch {} L49638: process.stderr.write([ L49639: "[screenpipe-mcp] could not discover SCREENPIPE_LOCAL_API_KEY from any source.", ... L49643: "Fix: set SCREENPIPE_LOCAL_API_KEY in your MCP launcher's env block,", L49644: "or install the screenpipe desktop app (https://screenpi.pe) so its CLI", L49645: "can resolve the key without bypassing Screenpipe's database boundary.",

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L49628

49555port, L49556: env = process.env L49557: }) { L49558: return (baseOverride || env.SCREENPIPE_LOCAL_API_URL || env.SCREENPIPE_API_URL || (env.SCREENPIPE_LOCAL_API_PORT ? `http://localhost:${env.SCREENPIPE_LOCAL_API_PORT}` : `http://${h... L49559: } ... L49569: const fs4 = require("fs"); L49570: const { execFile: execFile2, exec } = require("child_process"); L49571: const { promisify: promisify2 } = require("util");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L49555

18941patternName = generic_password severity = medium line = 18941 matchedText = newUrl.p...d%";

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L18941

Source & flagged code

12 flagged

dist/http-server.jsView file

35544exports2.execAsync = undefined; L35545: var child_process = require("child_process"); L35546: var util = require("util");

High

Child Process

Package source references child process execution.

dist/http-server.jsView on unpkg · L35544

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/http-server.js: // node_modules/zod/v4/core/core.js // node_modules/zod/v4/core/util.js // node_modules/zod/v4/core/errors.js // node_modules/zod/v4/core/parse.js // node_modules/zod/v4/core/regexes.js // node_modules/zod/v4/core/checks.js // node_modules/zod/v4/core/doc.js // node_modules/zod/v4/core/versions.js

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/http-server.jsView on unpkg

159Cross-file remote execution chain: dist/http-server.js spawns dist/index.js; helper contains network access plus dynamic code execution. L159: assignProp: () => assignProp, L160: base64ToUint8Array: () => base64ToUint8Array, L161: base64urlToUint8Array: () => base64urlToUint8Array, ... L924: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L925: } : { success: true, data: result.value }; L926: }, safeParse, _safeParseAsync = (_Err) => async (schema, value, _ctx) => { ... L1999: try { L2000: new URL(`http://[${payload.value}]`); L2001: } catch { ... L9152: id = normalizeId(id); L9153: return resolver.resolve(baseId, id); L9154: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/http-server.jsView on unpkg · L159

19926patternName = generic_password severity = medium line = 19926 matchedText = newUrl.p...d%";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/http-server.jsView on unpkg · L19926

dist/cli.jsView file

159assignProp: () => assignProp, L160: base64ToUint8Array: () => base64ToUint8Array, L161: base64urlToUint8Array: () => base64urlToUint8Array, ... L924: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L925: } : { success: true, data: result.value }; L926: }, safeParse, _safeParseAsync = (_Err) => async (schema, value, _ctx) => { ... L1999: try { L2000: new URL(`http://[${payload.value}]`); L2001: } catch { ... L9152: id = normalizeId(id); L9153: return resolver.resolve(baseId, id); L9154: }

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.jsView on unpkg · L159

51024Trigger-reachable chain: scripts.start -> dist/cli.js L51024: if (budgetLeft() > 0) { L51025: const { stdout } = await execAsync("npx screenpipe@latest auth token", { L51026: timeout: Math.min(PER_CANDIDATE_MS, budgetLeft()), ... L51033: } catch {} L51034: process.stderr.write([ L51035: "[screenpipe-mcp] could not discover SCREENPIPE_LOCAL_API_KEY from any source.", ... L51039: "Fix: set SCREENPIPE_LOCAL_API_KEY in your MCP launcher's env block,", L51040: "or install the screenpipe desktop app (https://screenpi.pe) so its CLI", L51041: "can resolve the key without bypassing Screenpipe's database boundary.",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L51024

9831sourceCode = this.opts.code.process(sourceCode, sch); L9832: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L9833: const validate = makeValidate(this, this.scope.get());

dist/index.jsView file

49628if (budgetLeft() > 0) { L49629: const { stdout } = await execAsync("npx screenpipe@latest auth token", { L49630: timeout: Math.min(PER_CANDIDATE_MS, budgetLeft()), ... L49637: } catch {} L49638: process.stderr.write([ L49639: "[screenpipe-mcp] could not discover SCREENPIPE_LOCAL_API_KEY from any source.", ... L49643: "Fix: set SCREENPIPE_LOCAL_API_KEY in your MCP launcher's env block,", L49644: "or install the screenpipe desktop app (https://screenpi.pe) so its CLI", L49645: "can resolve the key without bypassing Screenpipe's database boundary.",

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L49628

49555port, L49556: env = process.env L49557: }) { L49558: return (baseOverride || env.SCREENPIPE_LOCAL_API_URL || env.SCREENPIPE_API_URL || (env.SCREENPIPE_LOCAL_API_PORT ? `http://localhost:${env.SCREENPIPE_LOCAL_API_PORT}` : `http://${h... L49559: } ... L49569: const fs4 = require("fs"); L49570: const { execFile: execFile2, exec } = require("child_process"); L49571: const { promisify: promisify2 } = require("util");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L49555

18941patternName = generic_password severity = medium line = 18941 matchedText = newUrl.p...d%";

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L18941