Loading npm security reports…
MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.
LPM treats this as warn-only first-party agent extension lifecycle risk. On npm postinstall, the package conditionally configures the consuming Suppa project's Claude hooks and repository guard files. This is an unconsented agent-extension lifecycle mutation, but the installed commands are a bundled schema validator and no exfiltration or remote payload chain was found.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
dist/tools/entityCode.jsView on unpkg · L81Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/version.jsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L27Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L27Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/version.jsView on unpkgPackage source references dynamic require/import behavior.
dist/tools/entityCode.jsView on unpkg · L81