Loading npm security reports…

spidra-mcp@0.5.0: Suspicious npm security report (Warn) | LPM Firewall

registry / spidra-mcp / 0.5.0

spidra-mcp@0.5.0

Official Spidra MCP server: AI-powered web scraping, crawling, and search tools for MCP clients

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No attack was identified. The server is an MCP client for Spidra scrape, search, and crawl tools, and the install hook only restyles the fastmcp OAuth consent page.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall runs the consent patch; the MCP server runs only when the user starts the spidra-mcp bin.

Impact

Install changes the dependency consent screen appearance. Credentials stay on the Spidra client path chosen by the operator environment, with no hidden recipient or agent-config write.

Mechanism

The patch locates fastmcp generateConsentScreen and replaces that method with static branded HTML that still submits to /oauth/consent. Tool calls send the caller-supplied API key through SpidraClient.

AI rationale

The published entrypoint is a Spidra MCP server whose tools call the official client with caller-supplied credentials, and the postinstall only restyles fastmcp's local OAuth consent HTML. That install-time dependency edit is package-aligned branding and does not harvest secrets, run a remote payload, or rewrite a foreign agent control surface.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-fastmcp-consent.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.jsView file

16Source sends the broad process environment to a literal external destination. L16: var require2 = createRequire(import.meta.url); L17: var { version: packageVersion } = require2("../package.json"); L18: var HTTP_MODE = process.env.HTTP_STREAMABLE_SERVER === "true"; L19: var PORT = Number(process.env.PORT || 3e3); ... L56: tokenEndpoint: `${process.env.SPIDRA_API_URL}/oauth/token`, L57: // fastmcp's default (loopback-only: http://localhost:*, http://127.0.0.1:*) L58: // covers CLI-style loopback clients (Claude Code, Cursor desktop, VS Code ... L84: }, L85: body: JSON.stringify({ access_token: accessToken }) L86: }); ... L90: } L91: const data = await response.json();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L16

16var require2 = createRequire(import.meta.url); L17: var { version: packageVersion } = require2("../package.json"); L18: var HTTP_MODE = process.env.HTTP_STREAMABLE_SERVER === "true"; L19: var PORT = Number(process.env.PORT || 3e3); ... L56: tokenEndpoint: `${process.env.SPIDRA_API_URL}/oauth/token`, L57: // fastmcp's default (loopback-only: http://localhost:*, http://127.0.0.1:*) L58: // covers CLI-style loopback clients (Claude Code, Cursor desktop, VS Code ... L84: }, L85: body: JSON.stringify({ access_token: accessToken }) L86: }); ... L90: } L91: const data = await response.json();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L16

16Trigger-reachable chain: manifest.bin -> dist/index.js L16: var require2 = createRequire(import.meta.url); L17: var { version: packageVersion } = require2("../package.json"); L18: var HTTP_MODE = process.env.HTTP_STREAMABLE_SERVER === "true"; L19: var PORT = Number(process.env.PORT || 3e3); ... L56: tokenEndpoint: `${process.env.SPIDRA_API_URL}/oauth/token`, L57: // fastmcp's default (loopback-only: http://localhost:*, http://127.0.0.1:*) L58: // covers CLI-style loopback clients (Claude Code, Cursor desktop, VS Code ... L84: }, L85: body: JSON.stringify({ access_token: accessToken }) L86: }); ... L90: } L91: const data = await response.json();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L16

16Trigger-reachable credential exfiltration chain: manifest.bin -> dist/index.js L16: var require2 = createRequire(import.meta.url); L17: var { version: packageVersion } = require2("../package.json"); L18: var HTTP_MODE = process.env.HTTP_STREAMABLE_SERVER === "true"; L19: var PORT = Number(process.env.PORT || 3e3); ... L56: tokenEndpoint: `${process.env.SPIDRA_API_URL}/oauth/token`, L57: // fastmcp's default (loopback-only: http://localhost:*, http://127.0.0.1:*) L58: // covers CLI-style loopback clients (Claude Code, Cursor desktop, VS Code ... L84: }, L85: body: JSON.stringify({ access_token: accessToken }) L86: }); ... L90: } L91: const data = await response.json();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L16

scripts/patch-fastmcp-consent.mjsView file

•matchType = normalized_sha256 matchedPackage = spidra-mcp@0.6.0 matchedPath = scripts/patch-fastmcp-consent.mjs matchedIdentity = npm:c3BpZHJhLW1jcA:0.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/patch-fastmcp-consent.mjsView on unpkg