registry / suppa-mcp-2 / 1.40.4

suppa-mcp-2@1.40.4

MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The package has an automatic project configuration hook, but its caller limits setup to projects identified as using Suppa schema code. The inspected auth, cache, and smoke-test behavior did not establish an unrelated secret recipient or concrete attack chain.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm; guarded setup runs only for an eligible Suppa application.

Impact

Qualifying projects receive automatic schema guard configuration; no unrelated credential exfiltration or malicious behavior was established.

Mechanism

The hook invokes a package-owned installer to add project agent hooks and related schema checks after checking opt-outs, install context, and project applicability.

AI rationale

Evidence

.claude/settings.jsonAGENTS.mdCLAUDE.md

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

The manifest runs a postinstall script that can set up entity-code guards.
The installer adds agent hooks and project documentation, but the postinstall caller checks for a Suppa application before invoking it.
Auth requests use a caller-provided URL; the inspected token-file logic only updates existing Suppa keys in a Suppa .env file.
The version module writes a local cache, and self-check starts the package’s own server for an MCP smoke test.

Evidence against

The install hook skips global installs, CI, opt-outs, the package’s own installation, and projects without Suppa schema code or an @suppa dependency.
No inspected source showed credential forwarding to an unrelated destination or a confirmed malicious chain.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = suppa-mcp-2@1.33.0 matchedIdentity = npm:c3VwcGEtbWNwLTI:1.33.0 similarity = 0.619 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.jsView on unpkg

24import { randomBytes } from "node:crypto"; L25: import { spawn } from "node:child_process"; L26: import { createServer } from "node:http";

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L24

dist/tools/entityCode.jsView file

81try { L82: const mod = await import(pathToFileURL(p).href); L83: return String(mod.BLOCKING_SUMMARY ?? "").trim() || "the house rules in SKILL.md";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/entityCode.jsView on unpkg · L81

dist/auth.js#virtual:normalized:round1View file

21import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

21Trigger-reachable chain: scripts.start -> dist/bin.js -> dist/server.js -> dist/auth.js L21: import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/selfcheck.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.30.0 matchedPath = dist/selfcheck.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfcheck.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.js

Findings

3 Critical7 High5 Medium5 Low

CriticalCredential Exfiltrationdist/auth.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/auth.js#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltadist/auth.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/auth.js

HighEntrypoint Foreign Package Code Overwritedist/version.js

HighCommand Output Exfiltrationdist/auth.js#virtual:normalized:round1

HighTrigger Reachable Credential Exfiltrationdist/auth.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/auth.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/selfcheck.js

Affected versions and remediation

This report applies to suppa-mcp-2@1.40.4.

See all versions of suppa-mcp-2 for other recorded verdicts.

Review the evidence and your use of suppa-mcp-2@1.40.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 11:18:17.026Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.