registry / AI-agent control-surface risk / suppa-mcp-2 / 1.40.6

suppa-mcp-2@1.40.6

MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The postinstall hook automatically mutates Claude Code settings and agent instruction files in eligible consumer projects. This is unconsented installation-time modification of an AI-agent control surface, supporting a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package locally in a project that the postinstall script recognizes as a Suppa application.

Impact

Agent behavior and project configuration are changed without a separate setup command or consent prompt.

Mechanism

The postinstall script launches the bundled installer, which adds Claude tool hooks and managed content to agent instruction files.

Policy narrative

The npm postinstall path conditionally invokes the bundled guard installer for recognized Suppa applications. The installer modifies Claude Code hooks and agent instruction files, so installation alone can change an AI-agent control surface.

AI rationale

Evidence

package.jsonskills/suppa-entity-code/scripts/postinstall.mjsskills/suppa-entity-code/scripts/install-entity-code-guards.mjs.claude/settings.jsonAGENTS.mdCLAUDE.md.githooks/pre-commit.gitlab/suppa-schema-gate.yml

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

The package runs a postinstall script automatically during installation.
When the install is local and outside CI, the script identifies a Suppa application and invokes its installer without a separate user command.
The installer adds Claude Code hooks and updates agent instruction files, changing how tools and agents handle entity-code work.
The installer runs these agent-configuration changes alongside git hook, CI, and package-script setup.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 1.95 MB of source, external domains: accounts.google.com, blocked.invalid, modern.suppa.me, registry.npmjs.org, service.example.com, sp.modern-expo.com

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = suppa-mcp-2@1.33.0 matchedIdentity = npm:c3VwcGEtbWNwLTI:1.33.0 similarity = 0.619 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.jsView on unpkg

24import { randomBytes } from "node:crypto"; L25: import { spawn } from "node:child_process"; L26: import { createServer } from "node:http";

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L24

dist/tools/entityCode.jsView file

81try { L82: const mod = await import(pathToFileURL(p).href); L83: return String(mod.BLOCKING_SUMMARY ?? "").trim() || "the house rules in SKILL.md";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/entityCode.jsView on unpkg · L81

dist/auth.js#virtual:normalized:round1View file

21import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

21Trigger-reachable chain: scripts.start -> dist/bin.js -> dist/server.js -> dist/auth.js L21: import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/selfcheck.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.30.0 matchedPath = dist/selfcheck.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfcheck.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.js

Findings

3 Critical7 High5 Medium5 Low

CriticalCredential Exfiltrationdist/auth.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/auth.js#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltadist/auth.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/auth.js

HighEntrypoint Foreign Package Code Overwritedist/version.js

HighCommand Output Exfiltrationdist/auth.js#virtual:normalized:round1

HighTrigger Reachable Credential Exfiltrationdist/auth.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/auth.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/selfcheck.js

Affected versions and remediation

This report applies to suppa-mcp-2@1.40.6.

See all versions of suppa-mcp-2 for other recorded verdicts.

Avoid installing suppa-mcp-2@1.40.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-09 11:18:57.468Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code