Loading npm security reports…

secretloop@0.5.0: AI-agent control-surface risk | LPM Firewall

registry / secretloop / 0.5.0

secretloop@0.5.0

Find exposed secrets, verify supported credentials with explicit consent, and act on them — in VS Code, on the command line, and over MCP. A GPY Analytics product.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The MCP server supplies agent-facing instructions that demand its findings be treated as final. This can hijack an AI consumer's security judgment when the MCP server is connected.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user or agent launches secretloop-mcp and connects an MCP client.

Impact

An AI agent may suppress independent review and report unverified findings as authoritative.

Mechanism

MCP prompt injection and forced verdict framing.

Policy narrative

When launched as an MCP server, the package returns instructions telling the consuming agent that its scanner verdicts are final and must not be reclassified or downgraded. It also frames unsuccessful operations as not clean. These are package-authored instructions directed at the AI control surface rather than neutral scan data, and can bias or override an agent's independent security assessment.

AI rationale

The package contains reviewer and AI-directed verdict-control text in its MCP implementation. Although it lacks an npm install hook, this is a concrete agent-control attack surface when its MCP entrypoint is used.

Evidence

out/mcp.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 92.0% confidence with low false-positive risk.

Evidence for policy risk

Source & flagged code

9 flagged · loading source

out/mcp.jsView file

57L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(s);continue}if(e.external){let u=e.exter... L59: `);if("message"in e&&typeof e.message=="string")return e.message;try{return JSON.stringify(e)}catch{return String(e)}}return String(e)}function ahe(e){return e.description}function... ... L66: || (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function Ybe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i}, ... L7

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

out/mcp.jsView on unpkg · L57

120`)||(u["#text"]="#text"in u?u["#text"]+l:l);for(let l of s)l.tag==="__proto__"&&DR(u),l.tag in u?Array.isArray(u[l.tag])?u[l.tag].push(l.value):u[l.tag]=[u[l.tag],l.value]:u[l.tag]... L121: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:t});return e},YRe=(e={})=>async({callerClientConfig:t}={})=>{e.logger?.de... L122: Multiple credential sources detected:

High

Child Process

Package source references child process execution.

out/mcp.jsView on unpkg · L120

66|| (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function Ybe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i},

High

Eval

Package source references dynamic code evaluation.

out/mcp.jsView on unpkg · L66

57L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(s);continue}if(e.external){let u=e.exter... L59: `);if("message"in e&&typeof e.message=="string")return e.message;try{return JSON.stringify(e)}catch{return String(e)}}return String(e)}function ahe(e){return e.description}function... ... L66: || (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function Ybe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i}, ... L7

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

out/mcp.jsView on unpkg · L57

1#!/usr/bin/env node L2: "use strict";var WX=Object.create;var Kh=Object.defineProperty;var JX=Object.getOwnPropertyDescriptor;var XX=Object.getOwnPropertyNames;var YX=Object.getPrototypeOf,QX=Object.proto... L3: `)}});var X0=P(G=>{"use strict";var qee=G&&G.__createBinding||(Object.create?(function(e,t,r,i){i===void 0&&(i=r);var n=Object.getOwnPropertyDescriptor(t,r);(!n||("get"in n?!t.__es... ... L6: `)} L7: };`)(...Object.values(this.closed))}};cg.Doc=nE});var iE=P(lg=>{"use strict";Object.defineProperty(lg,"__esModule",{value:!0});lg.version=void 0;lg.version={major:4,minor:5,patch:1... L8: for (let i = 0; i < ${M}.issues.length; i++) { ... L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/mcp.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var WX=Object.create;var Kh=Object.defineProperty;var JX=Object.getOwnPropertyDescriptor;var XX=Object.getOwnPropertyNames;var YX=Object.getPrototypeOf,QX=Object.proto... L3: `)}});var X0=P(G=>{"use strict";var qee=G&&G.__createBinding||(Object.create?(function(e,t,r,i){i===void 0&&(i=r);var n=Object.getOwnPropertyDescriptor(t,r);(!n||("get"in n?!t.__es... ... L6: `)} L7: };`)(...Object.values(this.closed))}};cg.Doc=nE});var iE=P(lg=>{"use strict";Object.defineProperty(lg,"__esModule",{value:!0});lg.version=void 0;lg.version={major:4,minor:5,patch:1... L8: for (let i = 0; i < ${M}.issues.length; i++) { ... L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

out/mcp.jsView on unpkg · L1

out/cli.jsView file

1Trigger-reachable chain: manifest.bin -> out/cli.js L1: #!/usr/bin/env node L2: "use strict";var yF=Object.create;var Xc=Object.defineProperty;var SF=Object.getOwnPropertyDescriptor;var xF=Object.getOwnPropertyNames;var EF=Object.getPrototypeOf,wF=Object.proto... L3: `).filter(a=>a.trim().length>0):nw(t,t),o=[],s=0,i=0;for(let a of n)switch(sn(a,e)){case"none":Li(t,a)?o.push(a):i++;break;case"generated":s++;break;default:break}return{files:o,ge... L4: `).filter(r=>r.trim().length>0)}}function ow(t,e,r){let n=r.trim();return n?`git could not list staged files: ${n}`:e?`git was killed by ${e} before it could list staged files.`:`g... L5: `,e-1)+1;if(e<=r)return null;let n=t.slice(r,e),o=/["'`]?([A-Za-z_$][A-Za-z0-9_$]*)["'`]?\s*(?::=|[:=])\s*$/.exec(n);return o?o[1]:null}function cw(t,e,r={}

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

out/cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> out/cli.js L1: #!/usr/bin/env node L2: "use strict";var yF=Object.create;var Xc=Object.defineProperty;var SF=Object.getOwnPropertyDescriptor;var xF=Object.getOwnPropertyNames;var EF=Object.getPrototypeOf,wF=Object.proto... L3: `).filter(a=>a.trim().length>0):nw(t,t),o=[],s=0,i=0;for(let a of n)switch(sn(a,e)){case"none":Li(t,a)?o.push(a):i++;break;case"generated":s++;break;default:break}return{files:o,ge... L4: `).filter(r=>r.trim().length>0)}}function ow(t,e,r){let n=r.trim();return n?`git could not list staged files: ${n}`:e?`git was killed by ${e} before it could list staged files.`:`g... L5: `,e-1)+1;if(e<=r)return null;let n=t.slice(r,e),o=/["'`]?([A-Za-z_$][A-Za-z0-9_$]*)["'`]?\s*(?::=|[:=])\s*$/.exec(n);return o?o[

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

out/cli.jsView on unpkg · L1

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

9 flagged

out/mcp.jsView file

57L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(s);continue}if(e.external){let u=e.exter... L59: `);if("message"in e&&typeof e.message=="string")return e.message;try{return JSON.stringify(e)}catch{return String(e)}}return String(e)}function ahe(e){return e.description}function... ... L66: || (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function Ybe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i}, ... L7

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

out/mcp.jsView on unpkg · L57

120`)||(u["#text"]="#text"in u?u["#text"]+l:l);for(let l of s)l.tag==="__proto__"&&DR(u),l.tag in u?Array.isArray(u[l.tag])?u[l.tag].push(l.value):u[l.tag]=[u[l.tag],l.value]:u[l.tag]... L121: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:t});return e},YRe=(e={})=>async({callerClientConfig:t}={})=>{e.logger?.de... L122: Multiple credential sources detected:

High

Child Process

Package source references child process execution.

out/mcp.jsView on unpkg · L120

66|| (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function Ybe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i},

High

Eval

Package source references dynamic code evaluation.

out/mcp.jsView on unpkg · L66

57L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(s);continue}if(e.external){let u=e.exter... L59: `);if("message"in e&&typeof e.message=="string")return e.message;try{return JSON.stringify(e)}catch{return String(e)}}return String(e)}function ahe(e){return e.description}function... ... L66: || (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function Ybe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i}, ... L7

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

out/mcp.jsView on unpkg · L57

1#!/usr/bin/env node L2: "use strict";var WX=Object.create;var Kh=Object.defineProperty;var JX=Object.getOwnPropertyDescriptor;var XX=Object.getOwnPropertyNames;var YX=Object.getPrototypeOf,QX=Object.proto... L3: `)}});var X0=P(G=>{"use strict";var qee=G&&G.__createBinding||(Object.create?(function(e,t,r,i){i===void 0&&(i=r);var n=Object.getOwnPropertyDescriptor(t,r);(!n||("get"in n?!t.__es... ... L6: `)} L7: };`)(...Object.values(this.closed))}};cg.Doc=nE});var iE=P(lg=>{"use strict";Object.defineProperty(lg,"__esModule",{value:!0});lg.version=void 0;lg.version={major:4,minor:5,patch:1... L8: for (let i = 0; i < ${M}.issues.length; i++) { ... L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/mcp.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var WX=Object.create;var Kh=Object.defineProperty;var JX=Object.getOwnPropertyDescriptor;var XX=Object.getOwnPropertyNames;var YX=Object.getPrototypeOf,QX=Object.proto... L3: `)}});var X0=P(G=>{"use strict";var qee=G&&G.__createBinding||(Object.create?(function(e,t,r,i){i===void 0&&(i=r);var n=Object.getOwnPropertyDescriptor(t,r);(!n||("get"in n?!t.__es... ... L6: `)} L7: };`)(...Object.values(this.closed))}};cg.Doc=nE});var iE=P(lg=>{"use strict";Object.defineProperty(lg,"__esModule",{value:!0});lg.version=void 0;lg.version={major:4,minor:5,patch:1... L8: for (let i = 0; i < ${M}.issues.length; i++) { ... L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

out/mcp.jsView on unpkg · L1

out/cli.jsView file

1Trigger-reachable chain: manifest.bin -> out/cli.js L1: #!/usr/bin/env node L2: "use strict";var yF=Object.create;var Xc=Object.defineProperty;var SF=Object.getOwnPropertyDescriptor;var xF=Object.getOwnPropertyNames;var EF=Object.getPrototypeOf,wF=Object.proto... L3: `).filter(a=>a.trim().length>0):nw(t,t),o=[],s=0,i=0;for(let a of n)switch(sn(a,e)){case"none":Li(t,a)?o.push(a):i++;break;case"generated":s++;break;default:break}return{files:o,ge... L4: `).filter(r=>r.trim().length>0)}}function ow(t,e,r){let n=r.trim();return n?`git could not list staged files: ${n}`:e?`git was killed by ${e} before it could list staged files.`:`g... L5: `,e-1)+1;if(e<=r)return null;let n=t.slice(r,e),o=/["'`]?([A-Za-z_$][A-Za-z0-9_$]*)["'`]?\s*(?::=|[:=])\s*$/.exec(n);return o?o[1]:null}function cw(t,e,r={}

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

out/cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> out/cli.js L1: #!/usr/bin/env node L2: "use strict";var yF=Object.create;var Xc=Object.defineProperty;var SF=Object.getOwnPropertyDescriptor;var xF=Object.getOwnPropertyNames;var EF=Object.getPrototypeOf,wF=Object.proto... L3: `).filter(a=>a.trim().length>0):nw(t,t),o=[],s=0,i=0;for(let a of n)switch(sn(a,e)){case"none":Li(t,a)?o.push(a):i++;break;case"generated":s++;break;default:break}return{files:o,ge... L4: `).filter(r=>r.trim().length>0)}}function ow(t,e,r){let n=r.trim();return n?`git could not list staged files: ${n}`:e?`git was killed by ${e} before it could list staged files.`:`g... L5: `,e-1)+1;if(e<=r)return null;let n=t.slice(r,e),o=/["'`]?([A-Za-z_$][A-Za-z0-9_$]*)["'`]?\s*(?::=|[:=])\s*$/.exec(n);return o?o[

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

out/cli.jsView on unpkg · L1

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg