Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@avidian/mcp-slack@0.4.0: Clean npm security report (Allow) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Passed — safe to install

No malicious behavior detected. 11 low-signal pattern(s) reviewed.

View on npm All versions

registry / @avidian/mcp-slack / 0.4.0

@avidian/mcp-slack@0.4.0

TOON-first Model Context Protocol server for Slack, with dual-token auth and both stdio and Streamable HTTP transports.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is an explicit MCP server for Slack with user-invoked Slack read/write tools, optional local file upload to Slack, and authenticated HTTP or stdio transport.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit CLI run or programmatic server start, then MCP tool invocation

Impact

Authorized MCP clients can perform Slack actions within configured token scopes and may upload a user-specified local file path to Slack.

Mechanism

Slack MCP server using @slack/web-api

Rationale

The suspicious primitives are aligned with a Slack MCP server and require explicit runtime use with provided tokens; there is no install-time execution, exfiltration endpoint, persistence, or foreign AI-agent control-surface mutation. The local file upload capability is documented and user-invoked rather than hidden malware behavior.

Evidence

package.jsondist/lib.cjsdist/index.jsREADME.md

Network endpoints2

slack.com/api/localhost:3000/mcp

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

low

Evidence for block

dist/lib.cjs exposes user-invoked Slack tools including search_messages and upload_file with optional file_path.
HTTP transport can bind to caller-selected host/port and accepts MCP requests after Bearer auth.

Evidence against

package.json has no install/postinstall/prepare lifecycle; prepublishOnly is publish-time build only.
dist/lib.cjs import path has no child_process, shell, eval, persistence, or agent control-surface writes.
Slack tokens are read from documented env vars and used to instantiate @slack/web-api WebClient.
Network behavior is package-aligned Slack API access plus optional local MCP HTTP transport.
README documents file_path risk and states library import has no side effects; CLI start is explicit.
dist/index.js child_process/eval hits are bundled dependency code patterns, not package attack logic.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 2.08 MB of source, external domains: docs.slack.dev, github.com, json-schema.org, raw.githubusercontent.com, slack.com

Source & flagged code

4 flagged · loading source

dist/index.jsView file

31544import { EventEmitter } from "node:events"; L31545: import childProcess from "node:child_process"; L31546: import path from "node:path";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31544

148prepack: "npm run build", L149: test: "npm run build && bash -c 'node --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=test-results.xml --import tsx --test... L150: "test:coverage": "npm run build && node --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=lcov.i...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L148

148prepack: "npm run build", L149: test: "npm run build && bash -c 'node --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=test-results.xml --import tsx --test... L150: "test:coverage": "npm run build && node --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=lcov.i... ... L160: "@types/retry": "0.12.0", L161: axios: "^1.16.0", L162: eventemitter3: "^5.0.1", L163: "form-data": "^4.0.4", L164: "is-electron": "2.2.2",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L148

22266sourceCode = this.opts.code.process(sourceCode, sch); L22267: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L22268: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L22266

Findings

3 High2 Medium6 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

91%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

Authoravidianity

Maintainersavidian

Version0.5.0

PublishedJul 3, 2026

LicenseMIT

Dependencies6

Integrityverified

Package size403 KB

Files9

Keywordsmcpmodel-context-protocolslacktoonaillm

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/lib.cjstypes → ./dist/lib.d.tsexports mapbin → mcp-slack

Runtimenode >=20

Artifact2.10 MB · 9 files1 signature(s) · provenance

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

dist/index.jsView file

31544import { EventEmitter } from "node:events"; L31545: import childProcess from "node:child_process"; L31546: import path from "node:path";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31544

148prepack: "npm run build", L149: test: "npm run build && bash -c 'node --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=test-results.xml --import tsx --test... L150: "test:coverage": "npm run build && node --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=lcov.i...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L148

148prepack: "npm run build", L149: test: "npm run build && bash -c 'node --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=test-results.xml --import tsx --test... L150: "test:coverage": "npm run build && node --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=lcov.i... ... L160: "@types/retry": "0.12.0", L161: axios: "^1.16.0", L162: eventemitter3: "^5.0.1", L163: "form-data": "^4.0.4", L164: "is-electron": "2.2.2",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L148

22266sourceCode = this.opts.code.process(sourceCode, sch); L22267: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L22268: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L22266