Loading npm security reports…

suppa-mcp-2: AI-agent control-surface risk | LPM Firewall

registry / suppa-mcp-2 / 1.21.1

suppa-mcp-2@1.21.1

MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.

AI Security Review

scanned 54m ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation changes a matching consumer repository and its AI-agent controls. It installs hooks that run a bundled guard before and after editor actions.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package in a qualifying Suppa project activates the postinstall script.

Impact

It can alter AI-agent behavior and development workflow without an explicit setup command from the project owner.

Mechanism

Install-time writes to consumer agent settings, repository hooks, and project files.

Policy narrative

On npm installation, the package derives the consumer repository from INIT_CWD and, when it finds Suppa-related code, runs its installer. That installer writes Claude Code PreToolUse, PostToolUse, and Stop hooks, modifies AGENTS.md and CLAUDE.md, creates a Git pre-commit hook and CI file, and changes the consumer package.json. These are unconsented install-time changes to a foreign project and a broad AI-agent control surface.

Rationale

The lifecycle hook performs automatic, multi-file mutation of consumer AI-agent and development controls. Guard conditions and product-oriented runtime networking do not remove the unconsented install-time control-surface change.

Evidence

package.jsonskills/suppa-entity-code/scripts/postinstall.mjsskills/suppa-entity-code/scripts/install-entity-code-guards.mjs.claude/settings.jsonAGENTS.mdCLAUDE.md.githooks/pre-commit.gitlab/suppa-schema-gate.yml

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/tools/entityCode.jsView file

81try { L82: const mod = await import(pathToFileURL(p).href); L83: return String(mod.BLOCKING_SUMMARY ?? "").trim() || "the house rules in SKILL.md";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/entityCode.jsView on unpkg · L81

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/auth.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.20.0 matchedPath = dist/auth.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth.jsView on unpkg

dist/tools/files.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.20.0 matchedPath = dist/tools/files.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/files.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 7-47json

7 "suppa-mcp": "dist/bin.js",

8 "suppa-entity-guards": "skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

9 },

10 "main": "dist/bin.js",

11 "files": [

12 "dist",

13 "skills",

14 "README.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=18"

19 },

20 "scripts": {

21 "build": "tsc",

22 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

23 "rebuild": "npm run clean && npm run build",

24 "start": "node dist/bin.js",

25 "dev": "tsc --watch",

26 "test": "node scripts/check-version-literals.mjs && vitest run",

27 "postinstall": "node skills/suppa-entity-code/scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "test:watch": "vitest",

29 "prepublishOnly": "npm run rebuild && npm test",

30 "inspect": "npx @modelcontextprotocol/inspector node dist/bin.js",

31 "schema:gate": "node skills/suppa-entity-code/scripts/entity-code-guard.mjs --ci .",

32 "guards:install": "node skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

33 },

34 "keywords": [

35 "mcp",

36 "model-context-protocol",

37 "suppa",

38 "modern-expo",

39 "ai",

40 "llm",

41 "tools",

42 "claude",

43 "copilot",

44 "cursor"

45 ],

46 "license": "MIT",

47 "repository": {

dist/tools/entityCode.jsView file

Lines 61-101javascript

61 .split("\\$")

62 .join("$");

63 }

64 catch {

65 return "";

66 }

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/auth.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.20.0 matchedPath = dist/auth.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth.jsView on unpkg

dist/tools/files.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.20.0 matchedPath = dist/tools/files.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/files.jsView on unpkg