registry / AI-agent control-surface risk / suppa-mcp-2 / 1.40.5

suppa-mcp-2@1.40.5

MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The automatic postinstall mutates AI-agent hooks and instruction files in qualifying consumer projects, establishing an unconsented agent-control-surface attack under the install policy. Its project checks and schema-gating purpose narrow the trigger but do not make the configuration change user-invoked.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package with npm in a project containing Suppa schema code or a Suppa SDK dependency.

Impact

The consuming project's agents receive package-installed instructions and run package-provided hooks during editing and turn completion.

Mechanism

The postinstall invokes an installer that writes Claude hook settings and managed instructions to agent instruction files.

Policy narrative

During npm installation, the postinstall checks the consuming project for Suppa schema indicators and then launches an installer. That installer adds Claude hooks and managed instructions to agent configuration files, changing how agents in the project behave without a separate user command.

AI rationale

Evidence

package.jsonskills/suppa-entity-code/scripts/postinstall.mjsskills/suppa-entity-code/scripts/install-entity-code-guards.mjs.claude/settings.jsonAGENTS.mdCLAUDE.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs the guard installer from an npm postinstall hook.
postinstall automatically invokes the installer for consuming projects containing Suppa schema code or a Suppa SDK dependency.
The installer writes Claude hook settings and adds hooks for tool writes and turn completion.
The installer also writes managed instructions into AGENTS.md and CLAUDE.md.

Evidence against

The postinstall skips CI, global installs, the package's own install, and projects without Suppa schema indicators.
The installed hooks run a package-provided entity schema checker.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 1.88 MB of source, external domains: accounts.google.com, blocked.invalid, modern.suppa.me, registry.npmjs.org, service.example.com, sp.modern-expo.com

Source & flagged code

12 flagged

package.jsonView file

Lines 9-49json

9 "suppa": "dist/cliBin.js",

10 "suppa-entity-guards": "skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

11 },

12 "main": "dist/bin.js",

13 "files": [

14 "dist",

15 "skills",

16 "README.md",

17 "LICENSE"

18 ],

19 "engines": {

20 "node": ">=18"

21 },

22 "scripts": {

23 "build": "tsc",

24 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

25 "rebuild": "npm run clean && npm run build",

26 "start": "node dist/bin.js",

27 "dev": "tsc --watch",

28 "test": "node scripts/check-version-literals.mjs && vitest run",

29 "postinstall": "node skills/suppa-entity-code/scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "test:watch": "vitest",

31 "prepublishOnly": "npm run rebuild && npm test",

32 "inspect": "npx @modelcontextprotocol/inspector node dist/bin.js",

33 "live:install": "node scripts/live-install.mjs",

34 "live:verify": "node scripts/verify-live-install.mjs",

35 "schema:gate": "node skills/suppa-entity-code/scripts/entity-code-guard.mjs --ci .",

36 "form:gate": "node skills/suppa-form-v2/scripts/validate-form-schema.mjs",

37 "sync:formbuilder": "node scripts/sync-formbuilder.mjs",

38 "guards:install": "node skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

39 },

40 "keywords": [

41 "mcp",

42 "model-context-protocol",

43 "suppa",

44 "modern-expo",

45 "ai",

46 "llm",

47 "tools",

48 "claude",

49 "copilot",

dist/auth.jsView file

Lines 4-44javascript

4 * Two responsibilities, both transparent to tools:

5 *

6 * 1. `maybeRefresh` — called from `tenants.ensureValid` before every request.

7 * If the stored access token is near expiry it GETs the refresh endpoint

8 * (under a per

dist/tools/entityCode.jsView file

Lines 61-101javascript

61 .split("\\$")

62 .join("$");

63 }

64 catch {

65 return "";

66 }

dist/auth.js#virtual:normalized:round1View file

21import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

21Trigger-reachable chain: scripts.start -> dist/bin.js -> dist/server.js -> dist/auth.js L21: import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/selfcheck.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.30.0 matchedPath = dist/selfcheck.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfcheck.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = suppa-mcp-2@1.33.0 matchedIdentity = npm:c3VwcGEtbWNwLTI:1.33.0 similarity = 0.619 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.js

Findings

3 Critical7 High5 Medium5 Low

CriticalCredential Exfiltrationdist/auth.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/auth.js#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltadist/auth.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/auth.js

HighEntrypoint Foreign Package Code Overwritedist/version.js

HighCommand Output Exfiltrationdist/auth.js#virtual:normalized:round1

HighTrigger Reachable Credential Exfiltrationdist/auth.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/auth.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/selfcheck.js

Affected versions and remediation

This report applies to suppa-mcp-2@1.40.5.

See all versions of suppa-mcp-2 for other recorded verdicts.

Avoid installing suppa-mcp-2@1.40.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-09 11:18:26.907Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code