registry / suppa-mcp-2 / 1.38.0

suppa-mcp-2@1.38.0

MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The postinstall performs agent configuration setup, so this merits a warning under the agent extension lifecycle policy. Its project checks and Suppa-specific purpose limit the risk, and the inspected authentication code did not establish credential exfiltration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package with npm in a project that passes the postinstall checks.

Impact

Agent behavior in that project gains schema-checking instructions and hooks; no malicious control or data theft was established.

Mechanism

The lifecycle script invokes the package's installer, which adds Suppa-specific hooks and managed documentation to the application.

AI rationale

Evidence

package.jsonskills/suppa-entity-code/scripts/postinstall.mjsskills/suppa-entity-code/scripts/install-entity-code-guards.mjs.claude/settings.jsonAGENTS.mdCLAUDE.md

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs a postinstall script during installation.
The postinstall skips global installs, CI, opt-outs, the package's own install, and projects without Suppa schema code or an @suppa dependency.
When its gates pass, postinstall invokes the bundled installer on the application root.
The installer adds Suppa-specific hooks to Claude Code settings and managed sections to AGENTS.md and CLAUDE.md.
The inspected authentication code writes Suppa tokens back to the matching environment file; no unrelated credential recipient was found.

Evidence against

The agent configuration setup is first-party and scoped to projects with Suppa schema code or an @suppa dependency.
No concrete credential exfiltration or unrelated network recipient was established.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

13 flagged

package.jsonView file

Lines 8-48json

8 "suppa-mcp": "dist/bin.js",

9 "suppa-entity-guards": "skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

10 },

11 "main": "dist/bin.js",

12 "files": [

13 "dist",

14 "skills",

15 "README.md",

16 "LICENSE"

17 ],

18 "engines": {

19 "node": ">=18"

20 },

21 "scripts": {

22 "build": "tsc",

23 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

24 "rebuild": "npm run clean && npm run build",

25 "start": "node dist/bin.js",

26 "dev": "tsc --watch",

27 "test": "node scripts/check-version-literals.mjs && vitest run",

28 "postinstall": "node skills/suppa-entity-code/scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "test:watch": "vitest",

30 "prepublishOnly": "npm run rebuild && npm test",

31 "inspect": "npx @modelcontextprotocol/inspector node dist/bin.js",

32 "live:install": "node scripts/live-install.mjs",

33 "live:verify": "node scripts/verify-live-install.mjs",

34 "schema:gate": "node skills/suppa-entity-code/scripts/entity-code-guard.mjs --ci .",

35 "guards:install": "node skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

36 },

37 "keywords": [

38 "mcp",

39 "model-context-protocol",

40 "suppa",

41 "modern-expo",

42 "ai",

43 "llm",

44 "tools",

45 "claude",

46 "copilot",

47 "cursor"

48 ],

dist/auth.jsView file

Lines 4-44javascript

4 * Two responsibilities, both transparent to tools:

5 *

6 * 1. `maybeRefresh` — called from `tenants.ensureValid` before every request.

7 * If the stored access token is near expiry it GETs the refresh endpoint

8 * (under a per

dist/tools/entityCode.jsView file

Lines 61-101javascript

61 .split("\\$")

62 .join("$");

63 }

64 catch {

65 return "";

66 }

dist/auth.js#virtual:normalized:round1View file

21import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

21Trigger-reachable chain: scripts.start -> dist/bin.js -> dist/server.js -> dist/auth.js L21: import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/selfcheck.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.30.0 matchedPath = dist/selfcheck.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfcheck.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = suppa-mcp-2@1.33.0 matchedIdentity = npm:c3VwcGEtbWNwLTI:1.33.0 similarity = 0.738 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.js

Findings

3 Critical9 High5 Medium5 Low

CriticalCredential Exfiltrationdist/auth.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/auth.js#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltadist/auth.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/auth.js

HighShell

HighEntrypoint Foreign Package Code Overwritedist/version.js

HighCommand Output Exfiltrationdist/auth.js#virtual:normalized:round1

HighTrigger Reachable Credential Exfiltrationdist/auth.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/auth.js#virtual:normalized:round1

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to suppa-mcp-2@1.38.0.

See all versions of suppa-mcp-2 for other recorded verdicts.

Review the evidence and your use of suppa-mcp-2@1.38.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 11:18:23.442Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.