Loading npm security reports…

xlsx-for-ai@4.0.10: Suspicious npm security report (Warn) | LPM Firewall

registry / xlsx-for-ai / 4.0.10

xlsx-for-ai@4.0.10

The missing reliability layer for spreadsheet work in LLM agents. Read, write, diff, validate, and analyze .xlsx files end-to-end — with merged cells, formulas, named ranges, conditional formatting, pivots, and charts preserved.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Global installation automatically configures the package's own Claude Code MCP extension. This establishes a first-party extension lifecycle risk, without confirmed malicious control hijacking.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A global npm installation by a non-root user outside CI; launching the MCP server also activates update checks.

Impact

Claude Code gains a package-managed extension, and future launches can use automatically updated code. No broader configuration takeover was established.

Mechanism

The install hook writes the package-owned server entry into Claude Code configuration. The running server can subsequently install the latest package release automatically.

AI rationale

The source establishes guarded, first-party agent extension setup and automatic updates, warranting a warning rather than a publication block. Filesystem inspection succeeded, but the citation service returned transport errors, so no citation IDs are available.

Evidence

package.jsonscripts/postinstall.jslib/mcp-register.jsmcp.jslib/auto-upgrade.js~/.claude.json

Network endpoints1

registry.npmjs.org

Decision evidence

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/installer-cleanup.jsView file

27const path = require('path'); L28: const { execFileSync } = require('child_process'); L29:

High

Child Process

Package source references child process execution.

lib/installer-cleanup.jsView on unpkg · L27

lib/mcp-register.jsView file

4* Register the xlsx-for-ai MCP server into Claude Code's user-scope config L5: * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT L6: * touched — it stays on the auditable drag-drop .mcpb bundle. ... L22: * L23: * Test isolation: XFA_CLAUDE_CONFIG overrides the ~/.claude.json path. L24: */ ... L35: function claudeConfigPath() { L36: return process.env.XFA_CLAUDE_CONFIG || path.join(os.homedir(), '.claude.json'); L37: } ... L96: // config we can merge into — treat it like a parse error so it routes L97: // through backup-and-skip rather than crashing on `config.mcpServers = {}`. L98: if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/mcp-register.jsView on unpkg · L4

lib/auto-upgrade.jsView file

14* - Opt-out: XFA_NO_AUTO_UPDATE=1 (and CI) disables it entirely. L15: * - Conservative action: only run `npm i -g` in place when the install dir L16: * is actually writable; otherwise print a one-line hint and move on. ... L28: const https = require('https'); L29: const { execFile } = require('child_process'); L30: const { configPath } = require('./config');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/auto-upgrade.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.6 matchedPath = lib/auto-upgrade.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auto-upgrade.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 96ae21b673d16afe signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = xlsx-for-ai@4.0.6 matchedPath = lib/auto-upgrade.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.6 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/auto-upgrade.jsView on unpkg

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

mcp.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.6 matchedPath = mcp.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp.jsView on unpkg

lib/discover.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.6 matchedPath = lib/discover.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/discover.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/installer-cleanup.jsView file

Lines 7-47javascript

7 * Safety model (blessed shape):

8 * - Dry-run by default. Nothing is deleted unless { confirm: true }.

9 * - Allowlist by construction: a candidate is only ever a directory whose

10 * basename is exactly 'xlsx-for-ai' AND whose parent is 'node_modules'.

11 * No globbing of other names; slack, google-sheets, etc. can't match.

12 * - The current authoritative global install is never removed (realpath

13 * comparison guards against symlink-based collisions).

14 * - Bounded enumeration — fixed depth, fixed candidate-prefix list.

15 *

16 * Pure-fs implementation (no shelling to find/rm) so there is no shell-

17 * injection surface and the guards are unit-testable.

18 *

19 * Test isolation:

20 * XFA_NPX_CACHE_DIR base dir scanned for npx caches (def ~/.npm/_npx)

21 * XFA_PREFIX_CANDIDATES ':'-separated prefixes to scan for globals

22 * XFA_CURRENT_GLOBAL path to the authoritative install (never removed)

23 */

24

25const fs = require('fs');

26const os = require('os');

27const path = require('path');

28const { execFileSync } = require('child_process');

29

High

Child Process

Package source references child process execution.

lib/installer-cleanup.jsView on unpkg · L27

30const PKG = 'xlsx-for-ai';

31

32function npxCacheBase() {

33 return process.env.XFA_NPX_CACHE_DIR || path.join(os.homedir(), '.npm', '_npx');

34}

35

36function prefixCandidates() {

37 // A defined override (even empty) is authoritative — empty means "scan no

38 // prefixes", never "fall through to the real system prefixes".

39 if (process.env.XFA_PREFIX_CANDIDATES !== undefined) {

40 return process.env.XFA_PREFIX_CANDIDATES.split(':').filter(Boolean);

41 }

42 const home = os.homedir();

43 const list = ['/usr/local', '/opt/homebrew', path.join(home, '.npm-global'), path.join(home, '.local')];

44 // nvm: each installed node version is its own prefix.

45 const nvmVersions = path.join(home, '.nvm', 'versions', 'node');

46 try {

47 for (const v of fs.readdirSync(nvmVersions)) {

lib/mcp-register.jsView file

Lines 1-24javascript

1'use strict';

2

3/**

4 * Register the xlsx-for-ai MCP server into Claude Code's user-scope config

5 * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT

6 * touched — it stays on the auditable drag-drop .mcpb bundle.

7 *

8 * Design decisions (resolved from the spec-gate):

9 * - Secret-safe logging: we only ever log the xlsx-for-ai entry's command

10 * path (old -> new). We never print other servers, and never env values.

lib/auto-upgrade.jsView file

Lines 1-34javascript

1'use strict';

2

3/**

4 * Best-effort self-upgrade check for the globally-installed xlsx-for-ai CLI.

5 *

6 * Design:

7 * - Fire-and-forget. Called detached from mcp.js main() after the stdio

8 * transport is connected; we never await it and never let it throw into

9 * the server. A hung network or a bad registry response is a no-op.

10 * - Quiet by default and STDERR-ONLY. mcp.js speaks the MCP protocol over

11

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

mcp.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.6 matchedPath = mcp.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp.jsView on unpkg

lib/discover.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.6 matchedPath = lib/discover.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/discover.jsView on unpkg