registry / suppa-mcp-2 / 1.39.0

suppa-mcp-2@1.39.0

MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The postinstall performs guarded, first-party agent configuration in projects using Suppa schema code, which warrants a warning under the agent integration policy. The inspected authentication code restricts token updates to the configured Suppa tenant and existing Suppa environment keys.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package in a non-CI, non-global project with Suppa schema code or a Suppa dependency, unless the opt-out variable is set.

Impact

The project’s agents receive additional rules and run the package’s guard during file-edit and turn-stop events; no credential exfiltration or other attack was established.

Mechanism

The postinstall launches the bundled installer, which adds Claude Code hooks and agent instruction files, along with other schema guard integration.

AI rationale

Evidence

package.jsonskills/suppa-entity-code/scripts/postinstall.mjsskills/suppa-entity-code/scripts/install-entity-code-guards.mjs.claude/settings.jsonAGENTS.mdCLAUDE.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall script that can install agent hooks and instructions into the consumer project.
The postinstall skips CI and global installs, and acts only when it finds Suppa schema code or a Suppa dependency in the consumer project.
The installer writes Claude Code hooks that run before and after file edits and when an agent turn stops; it also installs agent instruction files.
Authentication token refresh is restricted to the configured Suppa tenant and updates only an existing Suppa key in its .env file.

Evidence against

The inspected source shows project-specific first-party guard setup, not credential forwarding to an unrelated endpoint.
The installer is explicitly invokable as a CLI and offers an opt-out environment variable.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

13 flagged

package.jsonView file

Lines 9-49json

9 "suppa": "dist/cliBin.js",

10 "suppa-entity-guards": "skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

11 },

12 "main": "dist/bin.js",

13 "files": [

14 "dist",

15 "skills",

16 "README.md",

17 "LICENSE"

18 ],

19 "engines": {

20 "node": ">=18"

21 },

22 "scripts": {

23 "build": "tsc",

24 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

25 "rebuild": "npm run clean && npm run build",

26 "start": "node dist/bin.js",

27 "dev": "tsc --watch",

28 "test": "node scripts/check-version-literals.mjs && vitest run",

29 "postinstall": "node skills/suppa-entity-code/scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "test:watch": "vitest",

31 "prepublishOnly": "npm run rebuild && npm test",

32 "inspect": "npx @modelcontextprotocol/inspector node dist/bin.js",

33 "live:install": "node scripts/live-install.mjs",

34 "live:verify": "node scripts/verify-live-install.mjs",

35 "schema:gate": "node skills/suppa-entity-code/scripts/entity-code-guard.mjs --ci .",

36 "form:gate": "node skills/suppa-form-v2/scripts/validate-form-schema.mjs",

37 "sync:formbuilder": "node scripts/sync-formbuilder.mjs",

38 "guards:install": "node skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

39 },

40 "keywords": [

41 "mcp",

42 "model-context-protocol",

43 "suppa",

44 "modern-expo",

45 "ai",

46 "llm",

47 "tools",

48 "claude",

49 "copilot",

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = suppa-mcp-2@1.33.0 matchedIdentity = npm:c3VwcGEtbWNwLTI:1.33.0 similarity = 0.690 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.jsView on unpkg

24import { randomBytes } from "node:crypto"; L25: import { spawn } from "node:child_process"; L26: import { createServer } from "node:http";

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L24

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.26.0 matchedPath = dist/auth.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.26.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth.jsView on unpkg

dist/tools/entityCode.jsView file

Lines 61-101javascript

61 .split("\\$")

62 .join("$");

63 }

64 catch {

65 return "";

66 }

dist/auth.js#virtual:normalized:round1View file

21import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

21Trigger-reachable chain: scripts.start -> dist/bin.js -> dist/server.js -> dist/auth.js L21: import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/selfcheck.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.30.0 matchedPath = dist/selfcheck.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfcheck.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.js

Findings

3 Critical8 High5 Medium5 Low

CriticalCredential Exfiltrationdist/auth.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/auth.js#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltadist/auth.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/auth.js

HighEntrypoint Foreign Package Code Overwritedist/version.js

HighCommand Output Exfiltrationdist/auth.js#virtual:normalized:round1

HighTrigger Reachable Credential Exfiltrationdist/auth.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/auth.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/auth.js

Affected versions and remediation

This report applies to suppa-mcp-2@1.39.0.

See all versions of suppa-mcp-2 for other recorded verdicts.

Review the evidence and your use of suppa-mcp-2@1.39.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 11:18:45.297Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.