registry / AI-agent control-surface risk / suppa-mcp-2 / 1.41.0

suppa-mcp-2@1.41.0

MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The automatic postinstall performs unconsented writes to a consuming project’s agent configuration and instructions, which meets the policy for blocking lifecycle mutation of an agent control surface. Project-specific gating and an opt-out reduce exposure but do not establish consent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package with npm in a non-CI, non-global Suppa application, unless the opt-out variable is set.

Impact

Agent behavior and project workflows may be changed as a side effect of installing the package.

Mechanism

The postinstall launches the bundled installer, which writes Claude hooks and agent instruction files and installs other project guards.

Policy narrative

During eligible npm installs, the package automatically configures the consuming Suppa project. Its installer adds Claude hooks and agent instructions, along with git, CI, and npm guard configuration. The opt-out and project checks limit when this runs, but do not require affirmative consent before changing the project’s agent control surface.

AI rationale

Evidence

package.jsonskills/suppa-entity-code/scripts/postinstall.mjsskills/suppa-entity-code/scripts/install-entity-code-guards.mjs

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest runs the guard installer from an automatic postinstall hook.
The postinstall skips CI, global installs, and the package’s own install, then requires a Suppa app; it has no consent prompt.
The installer adds hooks to Claude’s PreToolUse, PostToolUse, and Stop events, and writes the updated settings file.
The installer creates or updates AGENTS.md and CLAUDE.md in the consumer repository.
The installer invokes routines that install agent hooks, agent instruction files, a git hook, CI configuration, and an npm script.

Evidence against

The postinstall has an explicit environment-variable opt-out and skips unrelated projects without Suppa schema code or a Suppa SDK dependency.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

12 flagged

package.jsonView file

Lines 9-49json

9 "suppa": "dist/cliBin.js",

10 "suppa-entity-guards": "skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

11 },

12 "main": "dist/bin.js",

13 "files": [

14 "dist",

15 "skills",

16 "README.md",

17 "LICENSE"

18 ],

19 "engines": {

20 "node": ">=18"

21 },

22 "scripts": {

23 "build": "tsc",

24 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

25 "rebuild": "npm run clean && npm run build",

26 "start": "node dist/bin.js",

27 "dev": "tsc --watch",

28 "test": "node scripts/check-version-literals.mjs && vitest run",

29 "postinstall": "node skills/suppa-entity-code/scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "test:watch": "vitest",

31 "prepublishOnly": "npm run rebuild && npm test",

32 "inspect": "npx @modelcontextprotocol/inspector node dist/bin.js",

33 "live:install": "node scripts/live-install.mjs",

34 "live:verify": "node scripts/verify-live-install.mjs",

35 "schema:gate": "node skills/suppa-entity-code/scripts/entity-code-guard.mjs --ci .",

36 "form:gate": "node skills/suppa-form-v2/scripts/validate-form-schema.mjs",

37 "sync:formbuilder": "node scripts/sync-formbuilder.mjs",

38 "guards:install": "node skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"

39 },

40 "keywords": [

41 "mcp",

42 "model-context-protocol",

43 "suppa",

44 "modern-expo",

45 "ai",

46 "llm",

47 "tools",

48 "claude",

49 "copilot",

dist/auth.jsView file

Lines 4-44javascript

4 * Two responsibilities, both transparent to tools:

5 *

6 * 1. `maybeRefresh` — called from `tenants.ensureValid` before every request.

7 * If the stored access token is near expiry it GETs the refresh endpoint

8 * (under a per

dist/tools/entityCode.jsView file

Lines 61-101javascript

61 .split("\\$")

62 .join("$");

63 }

64 catch {

65 return "";

66 }

dist/auth.js#virtual:normalized:round1View file

21import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

21Trigger-reachable chain: scripts.start -> dist/bin.js -> dist/server.js -> dist/auth.js L21: import { randomBytes } from "node:crypto"; L22: import { spawn } from "node:child_process"; L23: import { createServer } from "node:http"; L24: import { readFileSync, statSync, writeFileSync } from "node:fs"; ... L43: function b64urlJson(segment) { L44: const buf = Buffer.from(segment, "base64url"); L45: return JSON.parse(buf.toString("utf-8")); ... L216: headers, L217: body: data, L218: signal: controller.signal, ... L345: const VERB_MISMATCH = new Set([404, 405]); L346: /** The verb that last worked for a host"s refresh route. */\nconst refreshVerb = new Map();\n/** A date a person can read, from epoch seconds. */\nfunction readableDate(epochSecon...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/auth.js#virtual:normalized:round1View on unpkg · L21

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

dist/selfcheck.jsView file

•matchType = normalized_sha256 matchedPackage = suppa-mcp-2@1.30.0 matchedPath = dist/selfcheck.js matchedIdentity = npm:c3VwcGEtbWNwLTI:1.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfcheck.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = suppa-mcp-2@1.33.0 matchedIdentity = npm:c3VwcGEtbWNwLTI:1.33.0 similarity = 0.476 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.js

Findings

3 Critical7 High5 Medium5 Low

CriticalCredential Exfiltrationdist/auth.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/auth.js#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltadist/auth.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/auth.js

HighEntrypoint Foreign Package Code Overwritedist/version.js

HighCommand Output Exfiltrationdist/auth.js#virtual:normalized:round1

HighTrigger Reachable Credential Exfiltrationdist/auth.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/auth.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/selfcheck.js

Affected versions and remediation

This report applies to suppa-mcp-2@1.41.0.

See all versions of suppa-mcp-2 for other recorded verdicts.

Avoid installing suppa-mcp-2@1.41.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-09 11:18:46.547Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code