Loading npm security reports…

xlsx-for-ai@4.0.3: Suspicious npm security report (Warn) | LPM Firewall

registry / xlsx-for-ai / 4.0.3

xlsx-for-ai@4.0.3

The missing reliability layer for spreadsheet work in LLM agents. Read, write, diff, validate, and analyze .xlsx files end-to-end — with merged cells, formulas, named ranges, conditional formatting, pivots, and charts preserved.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A global install automatically adds this package's MCP command to the user's Claude Code configuration. When that MCP server starts, it can fetch a remote catalog and automatically reinstall the package from the registry.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Global npm installation, followed by starting the registered MCP server.

Impact

It changes an AI-agent control surface without a separate setup command and permits the publisher to alter exposed tool capabilities or replace the global package later.

Mechanism

Install-time MCP registration, remote tool catalog relay, and runtime self-update.

AI rationale

This is not proven malware, but it performs unprompted AI-agent configuration mutation and later receives publisher-controlled capabilities and updates. The narrow package-specific registration and install guards reduce, but do not remove, the risk.

Evidence

package.jsonscripts/postinstall.jslib/mcp-register.jslib/auto-upgrade.jsmcp.jslib/discover.js~/.claude.json~/.claude.json.bak-<timestamp>~/.xlsx-for-ai/upgrade-check.json~/.xlsx-for-ai/tools-cache-<hash>.json

Network endpoints2

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/installer-cleanup.jsView file

27const path = require('path'); L28: const { execFileSync } = require('child_process'); L29:

High

Child Process

Package source references child process execution.

lib/installer-cleanup.jsView on unpkg · L27

lib/mcp-register.jsView file

4* Register the xlsx-for-ai MCP server into Claude Code's user-scope config L5: * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT L6: * touched — it stays on the auditable drag-drop .mcpb bundle. ... L22: * L23: * Test isolation: XFA_CLAUDE_CONFIG overrides the ~/.claude.json path. L24: */ ... L35: function claudeConfigPath() { L36: return process.env.XFA_CLAUDE_CONFIG || path.join(os.homedir(), '.claude.json'); L37: } ... L96: // config we can merge into — treat it like a parse error so it routes L97: // through backup-and-skip rather than crashing on `config.mcpServers = {}`. L98: if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/mcp-register.jsView on unpkg · L4

lib/auto-upgrade.jsView file

14* - Opt-out: XFA_NO_AUTO_UPDATE=1 (and CI) disables it entirely. L15: * - Conservative action: only run `npm i -g` in place when the install dir L16: * is actually writable; otherwise print a one-line hint and move on. ... L28: const https = require('https'); L29: const { execFile } = require('child_process'); L30: const { configPath } = require('./config');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/auto-upgrade.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@3.2.9 matchedPath = lib/auto-upgrade.js matchedIdentity = npm:eGxzeC1mb3ItYWk:3.2.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auto-upgrade.jsView on unpkg

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

mcp.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@3.2.9 matchedPath = mcp.js matchedIdentity = npm:eGxzeC1mb3ItYWk:3.2.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp.jsView on unpkg

lib/discover.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = xlsx-for-ai@4.0.1 matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.1 similarity = 0.938 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/discover.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 22-62json

22 "lib/discover.js",

23 "lib/register.js",

24 "lib/mcp-register.js",

25 "lib/setup.js",

26 "lib/installer-cleanup.js",

27 "scripts/postinstall.js",

28 "generated/tool-floor.generated.js",

29 "samples/reporting-pack-v1.xlsx",

30 "samples/reporting-pack-v2.xlsx",

31 "README.md",

32 "SECURITY.md",

33 "LICENSE"

34 ],

35 "scripts": {

36 "test": "node --test test/v2/*.test.js",

37 "build-manifests": "node scripts/build-manifests.js",

38 "tool-floor:generate": "node scripts/gen-tool-floor.js",

39 "tool-floor:check": "node scripts/gen-tool-floor.js --check",

40 "check-publish-allowlist": "node scripts/check-publish-allowlist.js",

41 "prepublishOnly": "node scripts/check-publish-allowlist.js",

42 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "keywords": [

45 "xlsx",

46 "excel",

47 "ai",

48 "mcp",

49 "claude",

50 "cursor",

51 "copilot",

52 "chatgpt",

53 "llm",

54 "agent",

55 "spreadsheet",

56 "json",

57 "mcp-server"

58 ],

59 "author": "senoff",

60 "license": "MIT",

61 "homepage": "https://github.com/senoff/xlsx-for-ai",

62 "repository": {

lib/installer-cleanup.jsView file

Lines 7-47javascript

7 * Safety model (blessed shape):

8 * - Dry-run by default. Nothing is deleted unless { confirm: true }.

9 * - Allowlist by construction: a candidate is only ever a directory whose

10

lib/mcp-register.jsView file

Lines 1-24javascript

1'use strict';

2

3/**

4 * Register the xlsx-for-ai MCP server into Claude Code's user-scope config

5 * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT

6 * touched — it stays on the auditable drag-drop .mcpb bundle.

7 *

8 * Design decisions (resolved from the spec-gate):

9 * - Secret-safe logging: we only ever log the xlsx-for-ai entry's command

10 * path (old -> new). We never print other servers, and never env values.

lib/auto-upgrade.jsView file

Lines 1-34javascript

1'use strict';

2

3/**

4 * Best-effort self-upgrade check for the globally-installed xlsx-for-ai CLI.

5 *

6 * Design:

7 * - Fire-and-forget. Called detached from mcp.js main() after the stdio

8 * transport is connected; we never await it and never let it throw into

9 * the server. A hung network or a bad registry response is a no-op.

10 * - Quiet by default and STDERR-ONLY. mcp.js speaks the MCP protocol over

11

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

mcp.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@3.2.9 matchedPath = mcp.js matchedIdentity = npm:eGxzeC1mb3ItYWk:3.2.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp.jsView on unpkg

lib/discover.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = xlsx-for-ai@4.0.1 matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.1 similarity = 0.938 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/discover.jsView on unpkg