Loading npm security reports…

suppa-mcp-2@1.30.0: AI-agent control-surface risk | LPM Firewall

registry / suppa-mcp-2 / 1.30.0

suppa-mcp-2@1.30.0

MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes a consuming repository's AI-agent hooks, agent instructions, Git hooks, CI configuration, and package scripts. This is an unconsented postinstall mutation of a foreign AI-agent control surface.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install of this package in a detected Suppa project.

Impact

The package can impose commands and instructions on future agent write events and repository commits without an explicit setup command.

Mechanism

Postinstall launches a repository guard installer that writes agent and development controls.

Policy narrative

The declared postinstall hook finds the consumer project and invokes an installer automatically. That installer writes Claude PreToolUse, PostToolUse, and Stop hooks, modifies agent instruction files, installs a pre-commit hook, changes Git hook configuration, and changes project CI and package scripts. These actions occur during dependency installation rather than through an explicit user setup command.

AI rationale

The package performs unconsented postinstall mutation of a consuming project's AI-agent control surface and development controls. Its scope checks do not make this automatic cross-project configuration safe.

Evidence

package.jsonskills/suppa-entity-code/scripts/postinstall.mjsskills/suppa-entity-code/scripts/install-entity-code-guards.mjsconsumer-repo/.claude/settings.jsonconsumer-repo/AGENTS.md

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = suppa-mcp-2@1.33.0 matchedIdentity = npm:c3VwcGEtbWNwLTI:1.33.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.jsView on unpkg

24import { randomBytes } from "node:crypto"; L25: import { spawn } from "node:child_process"; L26: import { createServer } from "node:http";

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L24

•matchType = token_shingles matchedPackage = suppa-mcp-2@1.35.0 matchedPath = dist/auth.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.35.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth.jsView on unpkg

dist/tools/entityCode.jsView file

81try { L82: const mod = await import(pathToFileURL(p).href); L83: return String(mod.BLOCKING_SUMMARY ?? "").trim() || "the house rules in SKILL.md";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/entityCode.jsView on unpkg · L81

dist/auth.js#virtual:normalized:round1View file

21import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

21Trigger-reachable chain: scripts.start -> dist/bin.js -> dist/server.js -> dist/auth.js L21: import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/selfcheck.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.35.0 matchedPath = dist/selfcheck.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.35.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfcheck.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 8-48json

8 "suppa-mcp": "dist/bin.js",

9 "suppa-entity-guards": "skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

10 },

11 "main": "dist/bin.js",

12 "files": [

13 "dist",

14 "skills",

15 "README.md",

16 "LICENSE"

17 ],

18 "engines": {

19 "node": ">=18"

20 },

21 "scripts": {

22 "build": "tsc",

23 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

24 "rebuild": "npm run clean && npm run build",

25 "start": "node dist/bin.js",

26 "dev": "tsc --watch",

27 "test": "node scripts/check-version-literals.mjs && vitest run",

28 "postinstall": "node skills/suppa-entity-code/scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "test:watch": "vitest",

30 "prepublishOnly": "npm run rebuild && npm test",

31 "inspect": "npx @modelcontextprotocol/inspector node dist/bin.js",

32 "live:install": "node scripts/live-install.mjs",

33 "live:verify": "node scripts/verify-live-install.mjs",

34 "schema:gate": "node skills/suppa-entity-code/scripts/entity-code-guard.mjs --ci .",

35 "guards:install": "node skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

36 },

37 "keywords": [

38 "mcp",

39 "model-context-protocol",

40 "suppa",

41 "modern-expo",

42 "ai",

43 "llm",

44 "tools",

45 "claude",

46 "copilot",

47 "cursor"

48 ],

dist/auth.jsView file

Lines 4-44javascript

4 * Two responsibilities, both transparent to tools:

5 *

6 * 1. `maybeRefresh` — called from `tenants.ensureValid` before every request.

7 * If the stored access token is near expiry it GETs the refresh endpoint

8 * (under a per

dist/tools/entityCode.jsView file

Lines 61-101javascript

61 .split("\\$")

62 .join("$");

63 }

64 catch {

65 return "";

66 }

dist/auth.js#virtual:normalized:round1View file

21import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

21Trigger-reachable chain: scripts.start -> dist/bin.js -> dist/server.js -> dist/auth.js L21: import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/selfcheck.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.35.0 matchedPath = dist/selfcheck.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.35.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfcheck.jsView on unpkg