warp-agent-mcp@0.20.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

warp-agent-mcp@0.20.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/run.mjsView file

9Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L9: import { homedir } from "node:os"; L10: import { spawn } from "node:child_process"; L11: import { fileURLToPath } from "node:url"; ... L13: L14: const __dirname = dirname(fileURLToPath(import.meta.url)); L15: // Point at dist/ (built from src/ at version-bump time) instead of the pre-baked ... L22: const homes = [ L23: process.env.HOME, L24: homedir(), ... L30: try { L31: const cfg = JSON.parse(readFileSync(join(h, ".warp", "config.json"), "utf8")); L32: if (cfg.api_key) return cfg.api_key;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/run.mjsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.3 matchedPath = scripts/run.mjs matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/run.mjsView on unpkg

scripts/postinstall.mjsView file

5L6: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; L7: import { join } from "node:path"; ... L77: // Check if already configured correctly L78: const existing = config?.mcpServers?.warp; L79: if (existing?.command === warpEntry.command && ... L85: // Add/update the warp entry L86: config.mcpServers = config.mcpServers || {}; L87: config.mcpServers.warp = warpEntry; L88: L89: try { L90: mkdirSync(configDir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.3 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client.js#virtual:normalized:round1View on unpkg

scripts/check-description.mjsView file

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.3 matchedPath = scripts/check-description.mjs matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check-description.mjsView on unpkg

bin/warp-agent-mcpView file

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.3 matchedPath = bin/warp-agent-mcp matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/warp-agent-mcpView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 16-56json

16 "cursor"

17 ],

18 "homepage": "https://github.com/warpfreight/warp-agent-mcp#readme",

19 "repository": {

20 "type": "git",

21 "url": "git+https://github.com/warpfreight/warp-agent-mcp.git"

22 },

23 "type": "module",

24 "bin": {

25 "warp-agent-mcp": "scripts/run.mjs"

26 },

27 "files": [

28 "bin",

29 "dist",

30 "scripts",

31 "server.json"

32 ],

33 "scripts": {

34 "build": "node scripts/sync-version.mjs && node scripts/build-widget.mjs && tsc && node scripts/add-shebang.mjs",

35 "dev": "tsc --watch",

36 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "check:desc": "node scripts/check-description.mjs",

38 "prepublishOnly": "npm run build && node scripts/check-description.mjs && node scripts/sync-manifest.mjs --check && node test/freight-review.mjs",

39 "test": "node test/refund.mjs && node test/e2e.mjs",

40 "test:call-readiness": "node test/call-readiness.mjs",

41 "sync:manifest": "node scripts/sync-manifest.mjs",

42 "test:freight-review": "node test/freight-review.mjs"

43 },

44 "dependencies": {

45 "@modelcontextprotocol/sdk": "^1.12.1",

46 "zod": "^3.24.4"

47 },

48 "devDependencies": {

49 "@modelcontextprotocol/ext-apps": "^1.7.2",

50 "@types/node": "^25.6.0",

51 "esbuild": "^0.28.0",

52 "typescript": "^5.8.3"

53 },

54 "engines": {

55 "node": ">=20"

56 },

scripts/run.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2/**

3 * MCP launcher — reads API key from ~/.warp/config.json and starts the server.

4 * This runs as the MCP command so it inherits the real HOME and filesystem access,

5 * unlike the bundled server which may run in a sandboxed context.

6 */

7import { readFileSync } from "node:fs";

8import { join } from

scripts/postinstall.mjsView file

Lines 1-25javascript

1/**

2 * postinstall — auto-configures Claude Desktop on install.

3 * Adds the warp MCP entry to claude_desktop_config.json if not already there.

4 */

5

6import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

7import { join } from "node:path";

Critical

dist/client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client.js#virtual:normalized:round1View on unpkg

scripts/check-description.mjsView file

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.3 matchedPath = scripts/check-description.mjs matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check-description.mjsView on unpkg

bin/warp-agent-mcpView file

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.3 matchedPath = bin/warp-agent-mcp matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/warp-agent-mcpView on unpkg