Loading npm security reports…

xlsx-for-ai@3.2.9: AI-agent control-surface risk | LPM Firewall

registry / xlsx-for-ai / 3.2.9

xlsx-for-ai@3.2.9

Let your agent work across all your spreadsheets. The MCP server that makes LLMs reliable on real-world Excel spreadsheets — thin npm client over a hosted API to read, write, diff, redact, and supervise .xlsx files from any MCP-aware agent.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install silently alters Claude Code's user MCP configuration to launch this package's MCP server. That server can read user-selected spreadsheets and send their base64 content to the hosted API.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install -g xlsx-for-ai activates postinstall; later Claude Code starts the registered MCP server.

Impact

Unconsented modification of a foreign AI-agent control surface; subsequent agent tool calls can transmit selected spreadsheet contents to the package API.

Mechanism

postinstall registration of a Claude Code MCP entry plus hosted spreadsheet relay

Policy narrative

On a non-CI, non-root global installation, the postinstall hook calls registerMcpServer and creates or modifies ~/.claude.json to register the xfa MCP command. This is an unconsented install-time mutation of Claude Code's user configuration. When Claude Code subsequently invokes that server, its spreadsheet tools base64-encode selected local files and relay them to api.xlsx-for-ai.dev; the server also includes a background global self-upgrade path.

Rationale

The global-install guards reduce scope but do not establish user consent for changing Claude Code configuration. This matches the blocking policy for install-time mutation of a foreign AI-agent control surface.

Evidence

package.jsonscripts/postinstall.jslib/mcp-register.jsmcp.jslib/auto-upgrade.js~/.claude.json~/.claude.json.bak-<timestamp>

Network endpoints2

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/installer-cleanup.jsView file

27const path = require('path'); L28: const { execFileSync } = require('child_process'); L29:

High

Child Process

Package source references child process execution.

lib/installer-cleanup.jsView on unpkg · L27

lib/mcp-register.jsView file

4* Register the xlsx-for-ai MCP server into Claude Code's user-scope config L5: * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT L6: * touched — it stays on the auditable drag-drop .mcpb bundle. ... L22: * L23: * Test isolation: XFA_CLAUDE_CONFIG overrides the ~/.claude.json path. L24: */ ... L35: function claudeConfigPath() { L36: return process.env.XFA_CLAUDE_CONFIG || path.join(os.homedir(), '.claude.json'); L37: } ... L96: // config we can merge into — treat it like a parse error so it routes L97: // through backup-and-skip rather than crashing on `config.mcpServers = {}`. L98: if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/mcp-register.jsView on unpkg · L4

lib/auto-upgrade.jsView file

14* - Opt-out: XFA_NO_AUTO_UPDATE=1 (and CI) disables it entirely. L15: * - Conservative action: only run `npm i -g` in place when the install dir L16: * is actually writable; otherwise print a one-line hint and move on. ... L28: const https = require('https'); L29: const { execFile } = require('child_process'); L30: const { configPath } = require('./config');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/auto-upgrade.jsView on unpkg · L14

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 22-62json

22 "lib/discover.js",

23 "lib/register.js",

24 "lib/mcp-register.js",

25 "lib/setup.js",

26 "lib/installer-cleanup.js",

27 "scripts/postinstall.js",

28 "generated/tool-floor.generated.js",

29 "samples/reporting-pack-v1.xlsx",

30 "samples/reporting-pack-v2.xlsx",

31 "README.md",

32 "SECURITY.md",

33 "LICENSE"

34 ],

35 "scripts": {

36 "test": "node --test test/v2/*.test.js",

37 "build-manifests": "node scripts/build-manifests.js",

38 "tool-floor:generate": "node scripts/gen-tool-floor.js",

39 "tool-floor:check": "node scripts/gen-tool-floor.js --check",

40 "check-publish-allowlist": "node scripts/check-publish-allowlist.js",

41 "prepublishOnly": "node scripts/check-publish-allowlist.js",

42 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "keywords": [

45 "xlsx",

46 "excel",

47 "ai",

48 "mcp",

49 "claude",

50 "cursor",

51 "copilot",

52 "chatgpt",

53 "llm",

54 "agent",

55 "spreadsheet",

56 "json",

57 "mcp-server"

58 ],

59 "author": "senoff",

60 "license": "MIT",

61 "homepage": "https://github.com/senoff/xlsx-for-ai",

62 "repository": {

lib/installer-cleanup.jsView file

Lines 7-47javascript

7 * Safety model (blessed shape):

8 * - Dry-run by default. Nothing is deleted unless { confirm: true }.

9 * - Allowlist by construction: a candidate is only ever a directory whose

10

lib/mcp-register.jsView file

Lines 1-24javascript

1'use strict';

2

3/**

4 * Register the xlsx-for-ai MCP server into Claude Code's user-scope config

5 * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT

6 * touched — it stays on the auditable drag-drop .mcpb bundle.

7 *

8 * Design decisions (resolved from the spec-gate):

9 * - Secret-safe logging: we only ever log the xlsx-for-ai entry's command

10 * path (old -> new). We never print other servers, and never env values.

lib/auto-upgrade.jsView file

Lines 1-34javascript

1'use strict';

2

3/**

4 * Best-effort self-upgrade check for the globally-installed xlsx-for-ai CLI.

5 *

6 * Design:

7 * - Fire-and-forget. Called detached from mcp.js main() after the stdio

8 * transport is connected; we never await it and never let it throw into

9 * the server. A hung network or a bad registry response is a no-op.

10 * - Quiet by default and STDERR-ONLY. mcp.js speaks the MCP protocol over

11

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg