Loading npm security reports…

xlsx-for-ai@4.0.6: AI-agent control-surface risk | LPM Firewall

registry / xlsx-for-ai / 4.0.6

xlsx-for-ai@4.0.6

The missing reliability layer for spreadsheet work in LLM agents. Read, write, diff, validate, and analyze .xlsx files end-to-end — with merged cells, formulas, named ranges, conditional formatting, pivots, and charts preserved.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation silently edits the user's Claude Code MCP configuration to launch this package's server. Later MCP-server startup can silently reinstall the package's latest release.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package globally triggers postinstall; starting the registered MCP server triggers the update check.

Impact

The package gains persistent access to an AI-agent control surface and can replace itself with a newer release without an explicit update command.

Mechanism

Postinstall MCP configuration mutation plus automatic global self-upgrade.

Policy narrative

On a normal global installation, npm runs postinstall, which registers the package's MCP executable in the user's Claude Code configuration. This persists a server entry outside the installed package. When that server starts, it performs an update check and, if the installed directory is writable, launches npm to install the latest release globally. The install-time agent configuration mutation is automatic rather than an explicit setup command, and the later self-upgrade can change the installed code.

AI rationale

The package automatically mutates a foreign AI-agent control surface during postinstall, which meets the install-control-surface blocking policy. Its runtime self-upgrade further makes the installed agent code mutable without an explicit update action.

Evidence

package.jsonscripts/postinstall.jslib/mcp-register.jsmcp.jslib/auto-upgrade.js

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/installer-cleanup.jsView file

27const path = require('path'); L28: const { execFileSync } = require('child_process'); L29:

High

Child Process

Package source references child process execution.

lib/installer-cleanup.jsView on unpkg · L27

lib/mcp-register.jsView file

4* Register the xlsx-for-ai MCP server into Claude Code's user-scope config L5: * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT L6: * touched — it stays on the auditable drag-drop .mcpb bundle. ... L22: * L23: * Test isolation: XFA_CLAUDE_CONFIG overrides the ~/.claude.json path. L24: */ ... L35: function claudeConfigPath() { L36: return process.env.XFA_CLAUDE_CONFIG || path.join(os.homedir(), '.claude.json'); L37: } ... L96: // config we can merge into — treat it like a parse error so it routes L97: // through backup-and-skip rather than crashing on `config.mcpServers = {}`. L98: if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/mcp-register.jsView on unpkg · L4

lib/auto-upgrade.jsView file

14* - Opt-out: XFA_NO_AUTO_UPDATE=1 (and CI) disables it entirely. L15: * - Conservative action: only run `npm i -g` in place when the install dir L16: * is actually writable; otherwise print a one-line hint and move on. ... L28: const https = require('https'); L29: const { execFile } = require('child_process'); L30: const { configPath } = require('./config');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/auto-upgrade.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.5 matchedPath = lib/auto-upgrade.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auto-upgrade.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 96ae21b673d16afe signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = xlsx-for-ai@4.0.5 matchedPath = lib/auto-upgrade.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.5 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/auto-upgrade.jsView on unpkg

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

mcp.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.5 matchedPath = mcp.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp.jsView on unpkg

lib/discover.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.5 matchedPath = lib/discover.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/discover.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 22-62json

22 "lib/discover.js",

23 "lib/register.js",

24 "lib/mcp-register.js",

25 "lib/setup.js",

26 "lib/installer-cleanup.js",

27 "scripts/postinstall.js",

28 "generated/tool-floor.generated.js",

29 "samples/reporting-pack-v1.xlsx",

30 "samples/reporting-pack-v2.xlsx",

31 "README.md",

32 "SECURITY.md",

33 "LICENSE"

34 ],

35 "scripts": {

36 "test": "node --test test/v2/*.test.js",

37 "build-manifests": "node scripts/build-manifests.js",

38 "tool-floor:generate": "node scripts/gen-tool-floor.js",

39 "tool-floor:check": "node scripts/gen-tool-floor.js --check",

40 "check-publish-allowlist": "node scripts/check-publish-allowlist.js",

41 "prepublishOnly": "node scripts/check-publish-allowlist.js",

42 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "keywords": [

45 "xlsx",

46 "excel",

47 "ai",

48 "mcp",

49 "claude",

50 "cursor",

51 "copilot",

52 "chatgpt",

53 "llm",

54 "agent",

55 "spreadsheet",

56 "json",

57 "mcp-server"

58 ],

59 "author": "senoff",

60 "license": "MIT",

61 "homepage": "https://github.com/senoff/xlsx-for-ai",

62 "repository": {

lib/installer-cleanup.jsView file

Lines 7-47javascript

7 * Safety model (blessed shape):

8 * - Dry-run by default. Nothing is deleted unless { confirm: true }.

9 * - Allowlist by construction: a candidate is only ever a directory whose

10

lib/mcp-register.jsView file

Lines 1-24javascript

1'use strict';

2

3/**

4 * Register the xlsx-for-ai MCP server into Claude Code's user-scope config

5 * (~/.claude.json, top-level `mcpServers`). Desktop is intentionally NOT

6 * touched — it stays on the auditable drag-drop .mcpb bundle.

7 *

8 * Design decisions (resolved from the spec-gate):

9 * - Secret-safe logging: we only ever log the xlsx-for-ai entry's command

10 * path (old -> new). We never print other servers, and never env values.

lib/auto-upgrade.jsView file

Lines 1-34javascript

1'use strict';

2

3/**

4 * Best-effort self-upgrade check for the globally-installed xlsx-for-ai CLI.

5 *

6 * Design:

7 * - Fire-and-forget. Called detached from mcp.js main() after the stdio

8 * transport is connected; we never await it and never let it throw into

9 * the server. A hung network or a bad registry response is a no-op.

10 * - Quiet by default and STDERR-ONLY. mcp.js speaks the MCP protocol over

11

samples/reporting-pack-v2.xlsxView file

•path = samples/reporting-pack-v2.xlsx kind = high_entropy_blob sizeBytes = 20593 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = compressed_blob sizeBytes = 20593 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

samples/reporting-pack-v2.xlsxView on unpkg

•path = samples/reporting-pack-v2.xlsx kind = nested_archive_needs_inspection sizeBytes = 20593 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

samples/reporting-pack-v2.xlsxView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

mcp.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.5 matchedPath = mcp.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp.jsView on unpkg

lib/discover.jsView file

•matchType = normalized_sha256 matchedPackage = xlsx-for-ai@4.0.5 matchedPath = lib/discover.js matchedIdentity = npm:eGxzeC1mb3ItYWk:4.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/discover.jsView on unpkg