Loading npm security reports…

spidra-mcp@0.6.0: AI-agent control-surface risk | LPM Firewall

registry / spidra-mcp / 0.6.0

spidra-mcp@0.6.0

Official Spidra MCP server: AI-powered web scraping, crawling, and search tools for MCP clients

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically modifies FastMCP, a foreign MCP framework dependency. The modification can reach a hoisted dependency copy and replaces its OAuth consent-screen implementation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation invokes the postinstall hook.

Impact

This unconsented lifecycle mutation changes a foreign AI-agent authentication control surface and may affect other consumers sharing the hoisted dependency.

Mechanism

The hook resolves fastmcp through Node resolution, finds matching distribution chunks, and overwrites them with a replacement consent-screen method.

Policy narrative

On installation, the package runs a script that locates FastMCP through normal module resolution, including a potentially hoisted copy in the consumer project. It searches that dependency's distribution files and writes a replacement OAuth consent screen. Because this changes a foreign MCP authentication interface automatically, it is an unconsented mutation of a broad AI-agent control surface, regardless of the package's ordinary Spidra client functionality.

AI rationale

The automatic postinstall hook overwrites a foreign, potentially shared FastMCP consent implementation. This is concrete install-hook abuse of an AI-agent control surface.

Evidence

package.jsonscripts/patch-fastmcp-consent.mjs

Decision evidence

public snapshot

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-fastmcp-consent.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.jsView file

16Source sends the broad process environment to a literal external destination. L16: var require2 = createRequire(import.meta.url); L17: var { version: packageVersion } = require2("../package.json"); L18: var HTTP_MODE = process.env.HTTP_STREAMABLE_SERVER === "true"; L19: var PORT = Number(process.env.PORT || 3e3); ... L56: tokenEndpoint: `${process.env.SPIDRA_API_URL}/oauth/token`, L57: // fastmcp's default (loopback-only: http://localhost:*, http://127.0.0.1:*) L58: // covers CLI-style loopback clients (Claude Code, Cursor desktop, VS Code ... L84: }, L85: body: JSON.stringify({ access_token: accessToken }) L86: }); ... L90: } L91: const data = await response.json();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L16

16var require2 = createRequire(import.meta.url); L17: var { version: packageVersion } = require2("../package.json"); L18: var HTTP_MODE = process.env.HTTP_STREAMABLE_SERVER === "true"; L19: var PORT = Number(process.env.PORT || 3e3); ... L56: tokenEndpoint: `${process.env.SPIDRA_API_URL}/oauth/token`, L57: // fastmcp's default (loopback-only: http://localhost:*, http://127.0.0.1:*) L58: // covers CLI-style loopback clients (Claude Code, Cursor desktop, VS Code ... L84: }, L85: body: JSON.stringify({ access_token: accessToken }) L86: }); ... L90: } L91: const data = await response.json();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L16

16Trigger-reachable chain: manifest.bin -> dist/index.js L16: var require2 = createRequire(import.meta.url); L17: var { version: packageVersion } = require2("../package.json"); L18: var HTTP_MODE = process.env.HTTP_STREAMABLE_SERVER === "true"; L19: var PORT = Number(process.env.PORT || 3e3); ... L56: tokenEndpoint: `${process.env.SPIDRA_API_URL}/oauth/token`, L57: // fastmcp's default (loopback-only: http://localhost:*, http://127.0.0.1:*) L58: // covers CLI-style loopback clients (Claude Code, Cursor desktop, VS Code ... L84: }, L85: body: JSON.stringify({ access_token: accessToken }) L86: }); ... L90: } L91: const data = await response.json();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L16

16Trigger-reachable credential exfiltration chain: manifest.bin -> dist/index.js L16: var require2 = createRequire(import.meta.url); L17: var { version: packageVersion } = require2("../package.json"); L18: var HTTP_MODE = process.env.HTTP_STREAMABLE_SERVER === "true"; L19: var PORT = Number(process.env.PORT || 3e3); ... L56: tokenEndpoint: `${process.env.SPIDRA_API_URL}/oauth/token`, L57: // fastmcp's default (loopback-only: http://localhost:*, http://127.0.0.1:*) L58: // covers CLI-style loopback clients (Claude Code, Cursor desktop, VS Code ... L84: }, L85: body: JSON.stringify({ access_token: accessToken }) L86: }); ... L90: } L91: const data = await response.json();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L16

scripts/patch-fastmcp-consent.mjsView file

•matchType = normalized_sha256 matchedPackage = spidra-mcp@0.2.5 matchedPath = scripts/patch-fastmcp-consent.mjs matchedIdentity = npm:c3BpZHJhLW1jcA:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/patch-fastmcp-consent.mjsView on unpkg