Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@avidian/mcp-slack@0.3.0: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 11 finding(s) warrant review before installing.

View on npm All versions

registry / @avidian/mcp-slack / 0.3.0

@avidian/mcp-slack@0.3.0

TOON-first Model Context Protocol server for Slack, with dual-token auth and both stdio and Streamable HTTP transports.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

An explicitly invoked MCP tool can read a caller-supplied local path and upload it to Slack. This is a real data-transfer capability, not install-time behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the CLI and an MCP client invokes slack_upload_file with file_path.

Impact

An authorized or exposed MCP client can exfiltrate process-readable files to Slack.

Mechanism

Local-file upload through Slack filesUploadV2

Rationale

The package appears purpose-aligned, but its exposed arbitrary local-file upload is a dangerous data-exfiltration capability. It warrants a warning rather than a block because it is user-invoked and has no malicious lifecycle chain.

Evidence

package.jsondist/lib.jsdist/index.jsREADME.md

Network endpoints1

slack.com/api/

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

dist/lib.js exposes slack_upload_file with arbitrary file_path

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

That tool passes file_path to filesUploadV2, sending it to Slack

CLI starts an MCP server on explicit user execution

HTTP mode accepts remote MCP requests with Bearer auth

Evidence against

package.json has only prepublishOnly; no install hooks
No package-owned child-process, eval, persistence, or agent-config writes found
Slack tokens are used for the declared Slack API client
HTTP handler requires Bearer authentication and limits request bodies

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 2.08 MB of source, external domains: docs.slack.dev, github.com, json-schema.org, raw.githubusercontent.com, slack.com

Source & flagged code

4 flagged · loading source

dist/index.jsView file

31544import { EventEmitter } from "node:events"; L31545: import childProcess from "node:child_process"; L31546: import path from "node:path";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31544

148prepack: "npm run build", L149: test: "npm run build && bash -c 'node --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=test-results.xml --import tsx --test... L150: "test:coverage": "npm run build && node --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=lcov.i...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L148

148prepack: "npm run build", L149: test: "npm run build && bash -c 'node --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=test-results.xml --import tsx --test... L150: "test:coverage": "npm run build && node --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=lcov.i... ... L160: "@types/retry": "0.12.0", L161: axios: "^1.16.0", L162: eventemitter3: "^5.0.1", L163: "form-data": "^4.0.4", L164: "is-electron": "2.2.2",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L148

22266sourceCode = this.opts.code.process(sourceCode, sch); L22267: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L22268: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L22266

Findings

3 High2 Medium6 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeData Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Authoravidianity

Maintainersavidian

Version0.5.0

PublishedJul 2, 2026

LicenseMIT

Dependencies6

Integrityverified

Package size404 KB

Files9

Keywordsmcpmodel-context-protocolslacktoonaillm

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/lib.cjstypes → ./dist/lib.d.tsexports mapbin → mcp-slack

Runtimenode >=20

Artifact2.10 MB · 9 files1 signature(s) · provenance

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

dist/index.jsView file

31544import { EventEmitter } from "node:events"; L31545: import childProcess from "node:child_process"; L31546: import path from "node:path";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31544

148prepack: "npm run build", L149: test: "npm run build && bash -c 'node --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=test-results.xml --import tsx --test... L150: "test:coverage": "npm run build && node --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=lcov.i...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L148

148prepack: "npm run build", L149: test: "npm run build && bash -c 'node --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=test-results.xml --import tsx --test... L150: "test:coverage": "npm run build && node --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=lcov.i... ... L160: "@types/retry": "0.12.0", L161: axios: "^1.16.0", L162: eventemitter3: "^5.0.1", L163: "form-data": "^4.0.4", L164: "is-electron": "2.2.2",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L148

22266sourceCode = this.opts.code.process(sourceCode, sch); L22267: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L22268: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L22266