registry / @calltelemetry/ct-lab-mcp / 0.8.28

@calltelemetry/ct-lab-mcp@0.8.28

⚠ Under review

Expanded Model Context Protocol (MCP) server for Call Telemetry lab, fleet, and appliance management across Proxmox VE and VMware ESXi.

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 105 file(s), 1007 KB of source, external domains: 127.0.0.1, 192.168.123.176, 192.168.123.177, 192.168.123.178, 192.168.124, 192.168.124.120, 192.168.124.229, api.doppler.com, dash.calltelemetry.com, schemas.cisco.com, schemas.xmlsoap.org, www.cisco.com

Source & flagged code

10 flagged

dist/src/tools/license-tools.jsView file

Lines 138-180javascript

138 source: "ct-dashboard",

139 issuedVia: issued.issuedVia,

140 licenseId: issued.licenseId,

141 dashboardOrgId: issued.orgId,

142 subscriptionType: issued.subscriptionType,

143 days: issued.durationDays,

144 expiresAt: issued.expiresAt,

145 keyPrefix: issued.keyPrefix,

146 keySuffix: issued.keySuffix,

147 notes: issued.notes,

148 vm

149 };

150 }

151 }

152 // 2. Authenticate to obtain session token

153 // Try provided credentials, or fallback candidate list

154 const candidateCredentials = [

155 ...(email && password ? [{ email, password }] : []),

156 { email: process.env.CT_TEST_USER_EMAIL || "demo@calltelemetry.com", password: process.env.CT_TEST_USER_PASSWORD || "demo" },

157 { email: process.env.CT_ADMIN_EMAIL || "test@calltelemetry.com", password: process.env.CT_ADMIN_PASSWORD || "Password123!" },

158 { email: "admin@calltelemetry.com", password: "Password123!" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/tools/license-tools.jsView on unpkg · L158

159 { email: "admin@calltelemetry.com", password: "calltelemetry" },

Medium

Secret Pattern

Hardcoded password in dist/src/tools/license-tools.js

dist/src/tools/license-tools.jsView on unpkg · L159

160 { email: "test@calltelemetry.com", password: "calltelemetry" }

Medium

Secret Pattern

Hardcoded password in dist/src/tools/license-tools.js

dist/src/tools/license-tools.jsView on unpkg · L160

161 ];

162 let authHeaders = { "Content-Type": "application/json" };

163 let authenticated = false;

164 let lastAuthError = "";

165 const sessionUrl = `${baseUrl}/api/session`;

166 for (const cred of candidateCredentials) {

167 try {

168 const sessionRes = await fetch(sessionUrl, {

169 method: "POST",

170 headers: { "Content-Type": "application/json" },

171 body: JSON.stringify({ user: { email: cred.email, password: cred.password } }),

172 dispatcher: insecureAgent,

173 signal: AbortSignal.timeout(Math.min(timeoutMs, 5000))

174 });

175 if (sessionRes.status === 200 || sessionRes.ok) {

176 const sessionData = (await sessionRes.json().catch(() => ({})));

177 const accessToken = sessionData?.access_token || sessionData?.data?.access_token || sessionData?.token;

178 const setCookie = sessionRes.headers.get("set-cookie") || "";

179 const sessionCookie = setCookie.split(";")[0];

180 if (sessionCookie) {

dist/bin/ct-lab-mcp.jsView file

Lines 176-216javascript

176 console.log("[ct-lab-mcp] Stopping purge daemon...");

177 controller.stop();

178 resolve(0);

179 };

180 process.once("SIGINT", handleSig);

181 process.

dist/src/tools/server-management.jsView file

Lines 99-139javascript

99 lines.push("| Target | Version / Revision | Status |");

100 lines.push("|---|---|---|");

101 lines.push(`| **Installed Runtime** | \`v${CURRENT_VERSION}\` | \`CURRENT\` |`

dist/src/tools/script-runner.jsView file

•matchType = normalized_sha256 matchedPackage = @calltelemetry/ct-lab-mcp@0.7.1 matchedPath = dist/src/tools/script-runner.js matchedIdentity = npm:[redacted]:0.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/tools/script-runner.jsView on unpkg

dist/src/tools/cube-canonical.jsView file

•matchType = normalized_sha256 matchedPackage = @calltelemetry/ct-lab-mcp@0.7.1 matchedPath = dist/src/tools/cube-canonical.js matchedIdentity = npm:[redacted]:0.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/tools/cube-canonical.jsView on unpkg

dist/src/credentials/resolver.jsView file

Lines 559-612javascript

559 baseUrl: isLab ? "https://192.168.123.177:8006/api2/json" : "https://192.168.123.178:8006/api2/json",

560 nodeName: isLab ? "proxmox" : "proxmox-mini",

561 auth

Source & flagged code

10 flagged · loading source

dist/src/tools/license-tools.js

@calltelemetry/ct-lab-mcp@0.8.28

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code