@cachly-dev/mcp-server@0.10.211
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: an MCP server for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 3d ago · by lpm-firewall-aiRuntime telemetry can forward the current Cachly JWT to an operator-configured API base without a recipient allowlist. The default recipient is the package’s Cachly API host, so the inspected behavior supports a conditional credential exposure warning, not a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A telemetry event during runtime, including selected instance or Redis errors; general telemetry calls are skipped when CACHLY_NO_TELEMETRY is set to 1.
Impact
A recipient selected through the API base can receive the Cachly credential. The inspected source supports a warning about conditional exposure, not a claim of malicious theft.
Mechanism
The runtime selects CACHLY_API_URL or defaults to https://api.cachly.dev, then sends telemetry containing the JWT. The source does not enforce a recipient allowlist for an overridden base.
AI rationale
Runtime telemetry can forward the current Cachly JWT to an operator-configured API base without a recipient allowlist. The default recipient is the package’s Cachly API host, so the inspected behavior supports a conditional credential exposure warning, not a block.
Evidence
dist/src/index.jsdist/src/credentials.js
Network endpoints2
api.cachly.dev/api/v1/telemetry/mcpCACHLY_API_URL/api/v1/telemetry/mcp
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runtime defaults its API base to api.cachly.dev and lets CACHLY_API_URL replace it.
- Telemetry sends the current JWT to that base on selected error paths, and a general telemetry sender includes the JWT in its request body unless CACHLY_NO_TELEMETRY is set to 1.
- The JWT can come from environment variables, saved Cachly credentials, or the Cachly MCP configuration.
- The inspected handler operations use Cachly instance and cache data for MCP tool behavior; they do not establish a separate attack.
- The postinstall hook prints setup guidance; the credential forwarding is in runtime code.
Evidence against
- The default telemetry recipient is the package’s Cachly API host.
- The postinstall hook does not perform the runtime credential transfer.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execFileSync as c}from"node:child_process";const f=e=>n=>{try{return n.startsWith("-")?"":c("git",["config",n],{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500,windowsHide:...
High
Findings
2 Critical11 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
CriticalPrevious Version Dangerous Deltadist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighRuntime Package Installdist/src/cls-hook.js
HighSemantic Analysis Limiteddist/src/doctor.js#virtual:normalized:round1
HighKnown Malware Source Similarityhooks/cachly-ambient-einblendung.mjs
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.211.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.211 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.