registry / Data exfiltration / social-autoposter
social-autoposter
Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.
This report shows the evidence for social-autoposter@1.7.7. 1 of 28 known versions is blocked or flagged. The newest version, 1.7.9, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource establishes automatic, remote transmission of user content and local operational data after MCP startup. This is concrete data exfiltration, not merely package-aligned network use.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Starting the package-owned MCP server after setup or client restart.
Impact
Remote disclosure of user prompts, tool-result excerpts, social-posting configuration, persona corpus, and subprocess output.
Mechanism
default background telemetry, log streaming, state sync, and transcript relay
Attack narrative
The MCP server starts a default-on relay that reads newly written Claude session transcripts from package-matching project folders, preserves user/assistant text and tool-result excerpts, and posts them to app.s4l.ai. It also sends raw subprocess logs plus configuration and persona-corpus snapshots to package-controlled endpoints; opt-out requires setting undocumented environment flags rather than affirmative consent.
AI rationale
Source establishes automatic, remote transmission of user content and local operational data after MCP startup. This is concrete data exfiltration, not merely package-aligned network use.
Evidence
mcp/dist/index.jsscripts/relay_session_transcripts.pymcp/dist/telemetry.jsmcp/install.mjspackage.json~/.claude/projects/*/*.jsonl~/.social-autoposter-mcp/transcript-relay-state.json~/.social-autoposter-mcp/config.jsonpersona_corpus.txt~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json
Network endpoints5
app.s4l.ai/api/v1/installations/logs/api/v1/installations/onboarding-events
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- mcp/dist/index.js relays Claude session transcripts by default every 5 minutes.
- scripts/relay_session_transcripts.py reads matching ~/.claude/projects/*.jsonl files and POSTs message text/tool results.
- mcp/dist/telemetry.js sends config, persona corpus, queues, and onboarding state to s4l.ai.
- mcp/dist/telemetry.js streams raw pipeline stdout/stderr to app.s4l.ai by default.
- mcp/install.mjs registers the server in Claude Desktop and Claude Code configs.
Evidence against
- package.json has no npm preinstall/install/postinstall hook.
- Transcript relay scopes itself to social-autoposter/s4l-worker project directories.
- Cookie import is described as an explicit confirmed setup action.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcebin/cookie-helper.jsView file
•matchType = normalized_sha256
matchedPackage = @m13v/s4l@1.7.5
matchedPath = bin/cookie-helper.js
matchedIdentity = npm:QG0xM3YvczRs:1.7.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/cookie-helper.jsView on unpkg13L14: const { spawn, spawnSync } = require('child_process');
L15: const fs = require('fs');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cookie-helper.jsView on unpkg · L13bin/scheduler/launchd.jsView file
4Trigger-reachable persistence chain: manifest.bin -> bin/cli.js -> bin/scheduler/index.js -> bin/scheduler/launchd.js
L4: const fs = require('fs');
L5: const { execSync, spawnSync } = require('child_process');
L6: const platform = require('../platform');
...
L32: \t<array>
L33: \t\t<string>/bin/bash</string>
L34: \t\t<string>${job.script}</string>
...
L38: \t<key>StandardOutPath</key>
L39: \t<string>${job.stdoutLog}</string>
L40: \t<key>StandardErrorPath</key>
...
L80: try {
L81: const out = execSync('launchctl list', { stdio: 'pipe', maxBuffer: 8 * 1024 * 1024 }).toString();
L82: for (const line of out.split('\n').slice(1)) {
Findings
6 High6 Medium4 Low
HighTrigger Reachable Persistencebin/scheduler/launchd.js
HighKnown Malware Source Similaritybin/cookie-helper.js
HighKnown Malware Source Similaritymcp/dist/screencast.js
HighKnown Malware Source Similaritybin/scheduler/launchd.js
HighKnown Malware Source Similaritymcp/shared/doctor.cjs
HighKnown Malware Source Similaritymcp/dist/onboarding.js
MediumDynamic Requirebin/cookie-helper.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/scheduler/launchd.js
MediumShips Build Helperskill/dm-outreach-reddit.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to social-autoposter@1.7.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing social-autoposter@1.7.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.