Loading npm security reports…

@calltelemetry/ct-lab-mcp@0.7.1: Malicious npm security report | LPM Firewall

registry / @calltelemetry/ct-lab-mcp / 0.7.1

@calltelemetry/ct-lab-mcp@0.7.1

Expanded Model Context Protocol (MCP) server for Call Telemetry lab, fleet, and appliance management across Proxmox VE and VMware ESXi.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

When invoked through MCP, the package can attempt appliance logins against a caller-selected host without TLS verification, forge a license token, and change appliance settings. Its remote command path can also overwrite an appliance CLI script with supplied content using sudo.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

An MCP client invokes the license or appliance command tools with a target host and arguments.

Impact

Unauthorized access, license modification, and remote appliance code execution are possible against reachable systems that accept the attempted credentials.

Mechanism

Credential-candidate login, forged license issuance, and privileged remote script replacement.

Attack narrative

The MCP server accepts a caller-selected appliance address, suppresses TLS certificate checks, and tries multiple credential candidates. On success it can create a signed license token using a built-in fallback signer and write it to the appliance settings API. Separately, its privileged SSH command builder accepts supplied script content and constructs a command that writes it with sudo to the appliance CLI path. These are concrete unauthorized-access and remote-control capabilities, not passive administration helpers.

AI rationale

Although no install-time hook runs, the published MCP tools expose an active chain for credential attempts, license forgery, and privileged remote modification of arbitrary caller-selected appliances. The absence of target allowlisting and TLS verification makes the capability concrete and unsafe.

Evidence

dist/src/tools/license-tools.jsdist/src/utils/license.jsdist/src/appliance/commands.js/api/session/api/org/:id/settings

Source & flagged code

8 flagged · loading source

dist/src/tools/license-tools.jsView file

87patternName = generic_password severity = medium line = 87

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/tools/license-tools.jsView on unpkg · L87

88patternName = generic_password severity = medium line = 88

Medium

Secret Pattern

Hardcoded password in dist/src/tools/license-tools.js

dist/src/tools/license-tools.jsView on unpkg · L88

89patternName = generic_password severity = medium line = 89

Medium

Secret Pattern

Hardcoded password in dist/src/tools/license-tools.js

dist/src/tools/license-tools.jsView on unpkg · L89

dist/bin/ct-lab-mcp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @calltelemetry/ct-lab-mcp@0.1.2 matchedIdentity = npm:[redacted]:0.1.2 similarity = 0.468 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/ct-lab-mcp.jsView on unpkg

167const scriptPath = path.resolve(__dirname, "../../scripts/live-physical-vm-benchmark.mjs"); L168: const { spawn } = await import("node:child_process"); L169: return new Promise((resolve) => {

High

Child Process

Package source references child process execution.

dist/bin/ct-lab-mcp.jsView on unpkg · L167

dist/src/tools/server-management.jsView file

117// Try local build first if in git repository, else npm install L118: const isGitRepo = execSync("git rev-parse --is-inside-work-tree 2>/dev/null || true", { cwd: process.cwd() }).toString().trim() === "true"; L119: if (isGitRepo) { ... L128: else { L129: lines.push(`1. 📦 Running \`npm install -g ${PACKAGE_NAME}@${targetVersion}\`...`); L130: const npmInstall = execSync(`npm install -g ${PACKAGE_NAME}@${targetVersion} 2>&1`, { timeout: 30000 }).toString();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/tools/server-management.jsView on unpkg · L117

dist/src/credentials/resolver.jsView file

496patternName = generic_password severity = medium line = 496

Medium

Secret Pattern

Hardcoded password in dist/src/credentials/resolver.js

dist/src/credentials/resolver.jsView on unpkg · L496

509patternName = generic_password severity = medium line = 509

Medium

Secret Pattern

Hardcoded password in dist/src/credentials/resolver.js

dist/src/credentials/resolver.jsView on unpkg · L509

Source & flagged code

8 flagged

dist/src/tools/license-tools.jsView file

Lines 67-109javascript

67 const parsed = ApplyLicenseInputSchema.safeParse(args);

68 if (!parsed.success) {

69 const issues = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");

70 return createToolErrorResult(ProxmoxErrorCode.VALIDATION_ERROR, issues);

71 }

72 const { targetIp, tier, days, orgId, token, email, password, timeoutMs } = parsed.data;

73 // Normalize target URL

74 let baseUrl = targetIp.trim();

75 if (!baseUrl.startsWith("http://") && !baseUrl.startsWith("https://")) {

76 baseUrl = `https://${baseUrl}`;

77 }

78 baseUrl = baseUrl.replace(/\/+$/, "");

79 logger.info(`Applying ${tier} license (${days} days) to org ${orgId} on ${baseUrl}...`);

80 try {

81 // 1. Authenticate to obtain session token

82 // Try provided credentials, or fallback candidate list

83 const candidateCredentials = [

84 ...(email && password ? [{ email, password }] : []),

85 { email: process.env.CT_TEST_USER_EMAIL || "demo@calltelemetry.com", password: process.env.CT_TEST_USER_PASSWORD || "demo" },

86 { email: process.env.CT_ADMIN_EMAIL || "test@calltelemetry.com", password: process.env.CT_ADMIN_PASSWORD || "Password123!" },

87 { email: "admin@calltelemetry.com", password: "Password123!" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/tools/license-tools.jsView on unpkg · L87

88 { email: "admin@calltelemetry.com", password: "calltelemetry" },

Medium

Secret Pattern

Hardcoded password in dist/src/tools/license-tools.js

dist/src/tools/license-tools.jsView on unpkg · L88

89 { email: "test@calltelemetry.com", password: "calltelemetry" }

Medium

Secret Pattern

Hardcoded password in dist/src/tools/license-tools.js

dist/src/tools/license-tools.jsView on unpkg · L89

90 ];

91 let authHeaders = { "Content-Type": "application/json" };

92 let authenticated = false;

93 let lastAuthError = "";

94 const sessionUrl = `${baseUrl}/api/session`;

95 for (const cred of candidateCredentials) {

96 try {

97 const sessionRes = await fetch(sessionUrl, {

98 method: "POST",

99 headers: { "Content-Type": "application/json" },

100 body: JSON.stringify({ user: { email: cred.email, password: cred.password } }),

101 dispatcher: insecureAgent,

102 signal: AbortSignal.timeout(Math.min(timeoutMs, 5000))

103 });

104 if (sessionRes.status === 200 || sessionRes.ok) {

105 const sessionData = (await sessionRes.json().catch(() => ({})));

106 const accessToken = sessionData?.access_token || sessionData?.data?.access_token || sessionData?.token;

107 const setCookie = sessionRes.headers.get("set-cookie") || "";

108 const sessionCookie = setCookie.split(";")[0];

109 if (sessionCookie) {

dist/bin/ct-lab-mcp.jsView file

Lines 147-187javascript

147 console.log("[ct-lab-mcp] Stopping purge daemon...");

148 controller.stop();

149 resolve(0);

150 };

151 process.once("SIGINT", handleSig);

152 process.

dist/src/tools/server-management.jsView file

Lines 97-137javascript

97 lines.push("| Target | Version / Revision | Status |");

98 lines.push("|---|---|---|");

99 lines.push(`| **Installed Runtime** | \`v${CURRENT_VERSION}\` | \`CURRENT\` |`

dist/src/credentials/resolver.jsView file

Lines 476-529javascript

476 baseUrl: isLab ? "https://192.168.123.177:8006/api2/json" : "https://192.168.123.178:8006/api2/json",

477 nodeName: isLab ? "proxmox" : "proxmox-mini",

478 auth