registry / @calltelemetry/ct-lab-mcp / 0.8.53

@calltelemetry/ct-lab-mcp@0.8.53

⚠ Under review

Expanded Model Context Protocol (MCP) server for Call Telemetry lab, fleet, and appliance management across Proxmox VE and VMware ESXi.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 23 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 122 file(s), 1.14 MB of source, external domains: 127.0.0.1, 192.168.123.176, 192.168.123.177, 192.168.123.178, 192.168.124, 192.168.124.120, 192.168.124.229, api.doppler.com, dash.calltelemetry.com, schemas.cisco.com, schemas.xmlsoap.org, storage.googleapis.com, www.cisco.com

Source & flagged code

14 flagged

dist/src/tools/verify-demo.jsView file

Lines 81-123javascript

81 baseUrl = baseUrl.replace(/\/+$/, "");

82 logger.info(`Running 5-point demo verification on ${baseUrl}...`);

83 const report = {

84 readyForDemo: false,

85 targetIp,

86 score: "0/5",

87 checks: {

88 apiAuth: { passed: false, message: "Not checked" },

89 license: { passed: false, message: "Not checked" },

90 cubes: { passed: false, message: "Not checked" },

91 phones: { passed: false, message: "Not checked" },

92 callRecords: { passed: false, message: "Not checked" }

93 },

94 issues: []

95 };

96 const authHeaders = { "Content-Type": "application/json" };

97 // Candidate credentials to attempt

98 const credentialsToTry = [

99 { email, password },

100 { email: process.env.CT_TEST_USER_EMAIL || "demo@calltelemetry.com", password: process.env.CT_TEST_USER_PASSWORD || "demo" },

101 { email: "admin@calltelemetry.com", password: "Password123!" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/tools/verify-demo.jsView on unpkg · L101

102 { email: "admin@calltelemetry.com", password: "calltelemetry" },

Medium

Secret Pattern

Hardcoded password in dist/src/tools/verify-demo.js

dist/src/tools/verify-demo.jsView on unpkg · L102

103 { email: "test@calltelemetry.com", password: "Password123!" }

Medium

Secret Pattern

Hardcoded password in dist/src/tools/verify-demo.js

dist/src/tools/verify-demo.jsView on unpkg · L103

104 ];

105 try {

106 // -------------------------------------------------------------

107 // Gate 1: API & Session Authentication Check

108 // -------------------------------------------------------------

109 let authenticated = false;

110 let authError = "";

111 const sessionUrl = `${baseUrl}/api/session`;

112 for (const cred of credentialsToTry) {

113 try {

114 const sessionRes = await fetch(sessionUrl, {

115 method: "POST",

116 headers: { "Content-Type": "application/json" },

117 body: JSON.stringify({ user: { email: cred.email, password: cred.password } }),

118 dispatcher: insecureAgent,

119 signal: AbortSignal.timeout(Math.min(timeoutMs, 5000))

120 });

121 if (sessionRes.status === 200 || sessionRes.ok) {

122 const sessionData = (await sessionRes.json().catch(() => ({})));

123 const accessToken = sessionData?.access_token || sessionData?.data?.access_token || sessionData?.token;

dist/bin/ct-lab-mcp.jsView file

Lines 169-209javascript

169 console.log("[ct-lab-mcp] Stopping purge daemon...");

170 controller.stop();

171 resolve(0);

172 };

173 process.once("SIGINT", handleSig);

174 process.

dist/src/tools/server-management.jsView file

Lines 99-139javascript

99 lines.push("| Target | Version / Revision | Status |");

100 lines.push("|---|---|---|");

101 lines.push(`| **Installed Runtime** | \`v${CURRENT_VERSION}\` | \`CURRENT\` |`

dist/src/tools/license-tools.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/tools/license-tools.js#virtual:normalized:round1View on unpkg

dist/src/tools/script-runner.jsView file

•matchType = normalized_sha256 matchedPackage = @calltelemetry/ct-lab-mcp@0.7.1 matchedPath = dist/src/tools/script-runner.js matchedIdentity = npm:[redacted]:0.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/tools/script-runner.jsView on unpkg

dist/src/tools/cube-canonical.jsView file

•matchType = normalized_sha256 matchedPackage = @calltelemetry/ct-lab-mcp@0.7.1 matchedPath = dist/src/tools/cube-canonical.js matchedIdentity = npm:[redacted]:0.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/tools/cube-canonical.jsView on unpkg

dist/src/tools/appliance-claim-tools.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @calltelemetry/ct-lab-mcp@0.7.0 matchedIdentity = npm:[redacted]:0.7.0 similarity = 0.610 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/tools/appliance-claim-tools.jsView on unpkg

dist/src/tools/license-tools.jsView file

Lines 224-266javascript

224 source: "ct-dashboard",

225 issuedVia: issued.issuedVia,

226 licenseId: issued.licenseId,

227 dashboardOrgId: issued.orgId,

228 subscriptionType: issued.subscriptionType,

229

dist/src/credentials/resolver.jsView file

579patternName = generic_password severity = medium line = 579

Medium

Secret Pattern

Hardcoded password in dist/src/credentials/resolver.js

dist/src/credentials/resolver.jsView on unpkg · L579

592patternName = generic_password severity = medium line = 592

Medium

Secret Pattern

Hardcoded password in dist/src/credentials/resolver.js

dist/src/credentials/resolver.jsView on unpkg · L592

Source & flagged code

14 flagged · loading source

dist/src/tools/verify-demo.js

@calltelemetry/ct-lab-mcp@0.8.53

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code