Loading npm security reports…

xlsx-for-ai@4.0.5: AI-agent control-surface risk | LPM Firewall

registry / xlsx-for-ai / 4.0.5

xlsx-for-ai@4.0.5

The missing reliability layer for spreadsheet work in LLM agents. Read, write, diff, validate, and analyze .xlsx files end-to-end — with merged cells, formulas, named ranges, conditional formatting, pivots, and charts preserved.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically modifies Claude Code's user-level MCP configuration to launch this package. The launched server can upload chosen spreadsheet contents to the hosted API and later self-upgrade through npm.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A non-root, non-CI global npm installation triggers registration; starting the registered MCP server triggers network activity and upgrade checks.

Impact

The package gains a persistent AI-agent launch entry without an explicit setup command and can send spreadsheet data to its service or replace itself with a later release.

Mechanism

Install-time Claude Code MCP registration plus remote spreadsheet relay and automatic npm self-upgrade.

Policy narrative

Installing this package globally runs postinstall and writes an xfa MCP entry into the user's Claude Code configuration. Claude Code can then launch the package automatically. Its MCP tools convert selected spreadsheet files to base64 and relay them to the hosted API. At server startup it also queries the npm registry and, when the package directory is writable, invokes npm to install the latest global release. The global-install and CI guards reduce scope but do not provide affirmative consent for modifying a separate AI-agent control surface.

AI rationale

This is malicious under the install-control-surface policy because an automatic postinstall hook mutates a foreign user-level AI-agent configuration. The persistent registration is coupled with remote data relay and runtime self-upgrade.

Evidence

package.jsonscripts/postinstall.jslib/mcp-register.jsmcp.jslib/client.js

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/installer-cleanup.jsView file

27const path = require('path'); L28: const { execFileSync } = require('child_process'); L29:

High

Child Process

Package source references child process execution.

lib/installer-cleanup.jsView on unpkg · L27

lib/mcp-register.jsView file

4* Register the xlsx-for-ai MCP server into Claude Code's user-scope config L5: * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT L6: * touched — it stays on the auditable drag-drop .mcpb bundle. ... L22: * L23: * Test isolation: XFA_CLAUDE_CONFIG overrides the ~/.claude.json path. L24: */ ... L35: function claudeConfigPath() { L36: return process.env.XFA_CLAUDE_CONFIG || path.join(os.homedir(), '.claude.json'); L37: } ... L96: // config we can merge into — treat it like a parse error so it routes L97: // through backup-and-skip rather than crashing on `config.mcpServers = {}`. L98: if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/mcp-register.jsView on unpkg · L4

lib/auto-upgrade.jsView file

14* - Opt-out: XFA_NO_AUTO_UPDATE=1 (and CI) disables it entirely. L15: * - Conservative action: only run `npm i -g` in place when the install dir L16: * is actually writable; otherwise print a one-line hint and move on. ... L28: const https = require('https'); L29: const { execFile } = require('child_process'); L30: const { configPath } = require('./config');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/auto-upgrade.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@3.2.9 matchedPath = lib/auto-upgrade.js matchedIdentity = npm:eGxzeC1mb3ItYWk:3.2.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auto-upgrade.jsView on unpkg

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

mcp.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@3.2.9 matchedPath = mcp.js matchedIdentity = npm:eGxzeC1mb3ItYWk:3.2.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 22-62json

22 "lib/discover.js",

23 "lib/register.js",

24 "lib/mcp-register.js",

25 "lib/setup.js",

26 "lib/installer-cleanup.js",

27 "scripts/postinstall.js",

28 "generated/tool-floor.generated.js",

29 "samples/reporting-pack-v1.xlsx",

30 "samples/reporting-pack-v2.xlsx",

31 "README.md",

32 "SECURITY.md",

33 "LICENSE"

34 ],

35 "scripts": {

36 "test": "node --test test/v2/*.test.js",

37 "build-manifests": "node scripts/build-manifests.js",

38 "tool-floor:generate": "node scripts/gen-tool-floor.js",

39 "tool-floor:check": "node scripts/gen-tool-floor.js --check",

40 "check-publish-allowlist": "node scripts/check-publish-allowlist.js",

41 "prepublishOnly": "node scripts/check-publish-allowlist.js",

42 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "keywords": [

45 "xlsx",

46 "excel",

47 "ai",

48 "mcp",

49 "claude",

50 "cursor",

51 "copilot",

52 "chatgpt",

53 "llm",

54 "agent",

55 "spreadsheet",

56 "json",

57 "mcp-server"

58 ],

59 "author": "senoff",

60 "license": "MIT",

61 "homepage": "https://github.com/senoff/xlsx-for-ai",

62 "repository": {

lib/installer-cleanup.jsView file

Lines 7-47javascript

7 * Safety model (blessed shape):

8 * - Dry-run by default. Nothing is deleted unless { confirm: true }.

9 * - Allowlist by construction: a candidate is only ever a directory whose

10

lib/mcp-register.jsView file

Lines 1-24javascript

1'use strict';

2

3/**

4 * Register the xlsx-for-ai MCP server into Claude Code's user-scope config

5 * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT

6 * touched — it stays on the auditable drag-drop .mcpb bundle.

7 *

8 * Design decisions (resolved from the spec-gate):

9 * - Secret-safe logging: we only ever log the xlsx-for-ai entry's command

10 * path (old -> new). We never print other servers, and never env values.

lib/auto-upgrade.jsView file

Lines 1-34javascript

1'use strict';

2

3/**

4 * Best-effort self-upgrade check for the globally-installed xlsx-for-ai CLI.

5 *

6 * Design:

7 * - Fire-and-forget. Called detached from mcp.js main() after the stdio

8 * transport is connected; we never await it and never let it throw into

9 * the server. A hung network or a bad registry response is a no-op.

10 * - Quiet by default and STDERR-ONLY. mcp.js speaks the MCP protocol over

11

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

mcp.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@3.2.9 matchedPath = mcp.js matchedIdentity = npm:eGxzeC1mb3ItYWk:3.2.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp.jsView on unpkg