registry / Install hook abuse / txamcp

txamcp

Txa_MCP - Professional MCP Server & CLI for Local AI Context Management

This report shows the evidence for txamcp@4.0.5. 1 of 2 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic lifecycle hook changes foreign AI-agent instruction locations and installs an extension, while the injected content directs AI behavior. This is concrete install-hook abuse rather than user-invoked setup.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall during package installation

Impact

A package installation can alter AI-agent behavior and add an extension across detected IDEs without an explicit setup command.

Mechanism

automatic AI instruction injection and IDE extension installation

Attack narrative

The manifest invokes postinstall. That hook copies package-controlled instructions into existing Gemini and Antigravity MCP directories, where the instructions direct an AI assistant to prefer Txa_MCP tools. In the same automatic hook, it invokes detected IDE commands to install the bundled VSIX. This is unconsented install-time modification of AI-agent and IDE control surfaces.

AI rationale

Evidence

package.jsonpostinstall.mjsinstructions.md~/.gemini/antigravity-ide/mcp/Txa_MCP/instructions.md~/.gemini/antigravity/mcp/Txa_MCP/instructions.md~/.gemini/config/mcp/Txa_MCP/instructions.mdtxamcp-vscode-4.0.5.vsix

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs postinstall automatically.
Postinstall writes package-supplied AI instructions into Gemini and Antigravity MCP directories under the user's home directory.
Those instructions tell an AI assistant to prefer this package's tools over generic IDE tools.
Postinstall silently installs the bundled VSIX into each detected IDE command.

Evidence against

No runtime dependency on another release of txamcp is declared.
Instruction deployment is skipped when the target MCP parent directory does not exist.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 131 KB of source, external domains: api.ipify.org, cdn.jsdelivr.net, cdn.tailwindcss.com, cdnjs.cloudflare.com, fonts.googleapis.com, registry.npmjs.org, txahub.click

Source & flagged code

13 flagged

package.jsonView file

Lines 2-42json

2 "name": "txamcp",

3 "version": "4.0.5",

4 "description": "Txa_MCP - Professional MCP Server & CLI for Local AI Context Management",

5 "type": "module",

6 "main": "mcp-server.mjs",

7 "bin": {

8 "txa": "cli.js"

9 },

10 "files": [

11 "cli.js",

12 "mcp-server.mjs",

13 "instructions.md",

14 "postinstall.mjs",

15 "README.md",

16 "LICENSE",

17 "CHANGELOG.md",

18 "*.vsix"

19 ],

20 "scripts": {

21 "start": "node mcp-server.mjs",

22 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "keywords": [

25 "mcp",

26 "txamcp",

27 "txa-mcp",

28 "ai",

29 "context",

30 "cli",

31 "ide",

32 "trae",

33 "cursor",

34 "windsurf"

35 ],

36 "author": "TXA Hub Team",

37 "license": "MIT",

38 "homepage": "https://txahub.click",

39 "dependencies": {

40 "@modelcontextprotocol/sdk": "^1.6.0",

41 "boxen": "^8.0.1",

42 "chalk": "^5.3.0",

mcp-server.mjsView file

14L15: import { exec } from "child_process"; L16: import { promisify } from "util";

High

Child Process

Package source references child process execution.

mcp-server.mjsView on unpkg · L14

690const cmd = os.platform() === 'win32' L691: ? 'powershell -Command "Get-ChildItem -Path . -Filter *.sql -Recurse -Depth 3 -Name -ErrorAction SilentlyContinue"' L692: : 'find . -maxdepth 3 -name "*.sql"';

High

Shell

Package source references shell execution.

mcp-server.mjsView on unpkg · L690

21import { createRequire } from "module"; L22: const require = createRequire(import.meta.url); L23: const pkg = require("./package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp-server.mjsView on unpkg · L21

cli.js#virtual:normalized:round1View file

495const hubUrl = await getHubUrl(); L496: await fetch(`${hubUrl}/api/auth/cli/cancel`, { L497: method: "POST", ... L499: body: JSON.stringify({ request_id: request_id }), L500: signal: AbortSignal.timeout(2000) // Don"t hang on exit\n });\n } catch (e) { }\n process.exit(0);\n };\n process.on("SIGINT", handleAbort);\n\n ... L501: console.log(chalk.gray.italic(" Advanced AI Context Management Hub\n"));

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli.js#virtual:normalized:round1View on unpkg · L495

485const dots = ".".repeat(statusDots); L486: process.stdout.write(`\r ${chalk.cyan("⏳")} ${chalk.gray("Waiting for authorization" + dots.padEnd(3, " "))}`); L487: }, 500); ... L495: const hubUrl = await getHubUrl(); L496: await fetch(`${hubUrl}/api/auth/cli/cancel`, { L497: method: "POST", ... L499: body: JSON.stringify({ request_id: request_id }), L500: signal: AbortSignal.timeout(2000) // Don"t hang on exit\n });\n } catch (e) { }\n process.exit(0);\n };\n process.on("SIGINT", handleAbort);\n\n ... L501: console.log(chalk.gray.italic(" Advanced AI Context Management Hub\n"));

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli.js#virtual:normalized:round1View on unpkg · L485

485Trigger-reachable command-output exfiltration chain: manifest.bin -> cli.js L485: const dots = ".".repeat(statusDots); L486: process.stdout.write(`\r ${chalk.cyan("⏳")} ${chalk.gray("Waiting for authorization" + dots.padEnd(3, " "))}`); L487: }, 500); ... L495: const hubUrl = await getHubUrl(); L496: await fetch(`${hubUrl}/api/auth/cli/cancel`, { L497: method: "POST", ... L499: body: JSON.stringify({ request_id: request_id }), L500: signal: AbortSignal.timeout(2000) // Don"t hang on exit\n });\n } catch (e) { }\n process.exit(0);\n };\n process.on("SIGINT", handleAbort);\n\n ... L501: console.log(chalk.gray.italic(" Advanced AI Context Management Hub\n"));

cli.jsView file

834try { L835: execSync("npm install -g txamcp@latest", { stdio: "inherit" }); L836: log.success("TXAMCP updated successfully!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.jsView on unpkg · L834

txamcp-vscode-4.0.5.vsixView file

•path = txamcp-vscode-4.0.5.vsix kind = high_entropy_blob sizeBytes = 574659 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

txamcp-vscode-4.0.5.vsixView on unpkg

•path = txamcp-vscode-4.0.5.vsix kind = compressed_blob sizeBytes = 574659 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

txamcp-vscode-4.0.5.vsixView on unpkg

•path = txamcp-vscode-4.0.5.vsix kind = nested_archive_needs_inspection sizeBytes = 574659 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

txamcp-vscode-4.0.5.vsixView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

mcp-server.mjsView file

14L15: import { exec } from "child_process"; L16: import { promisify } from "util";

High

Child Process

Package source references child process execution.

mcp-server.mjsView on unpkg · L14

Findings

9 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processmcp-server.mjs

HighShellmcp-server.mjs

HighSame File Env Network Executioncli.js#virtual:normalized:round1

HighCommand Output Exfiltrationcli.js#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationcli.js#virtual:normalized:round1

HighRuntime Package Installcli.js

HighShips High Entropy Blobtxamcp-vscode-4.0.5.vsix

HighSemantic Analysis Limitedcli.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiremcp-server.mjs

MediumNetwork

Affected versions and remediation

This report applies to txamcp@4.0.5.

The versions list below shows the verdict for each recorded version.

Avoid installing txamcp@4.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-30 16:48:25.036Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

4.0.5latestshownMaliciousInstall Hook AbuseBlockPublishedAug 30, 2026, 6:24 AM 3.5.13Suspicious—WarnPublishedJul 14, 2026, 10:17 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other install hook abuse packages

Behavioral surface

Related packages

Other install hook abuse packages

Source & flagged code