registry / Credential exfiltration / @catchmexz/fedin-vibe-mcp-server-workbuddy
@catchmexz/fedin-vibe-mcp-server-workbuddy
This report shows the evidence for @catchmexz/fedin-vibe-mcp-server-workbuddy@1.9.0. 1 of 4 known versions is blocked or flagged. The newest version, 2.0.0, is flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe deploy flow can transmit credentials from a project’s plain `.env` file to the package’s deployment service. That credential exposure is separate from the user’s request to deploy project files, so this is malicious credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the `deploy` tool with a project path.
Impact
If the project has a plain `.env` file, its credentials may be disclosed to the deployment service without a separate warning or consent.
Mechanism
The tool recursively archives project files, omitting `.env.local` variants but not plain `.env`, then uploads the ZIP to ai.fedin.cn.
Attack narrative
When a user requests deployment, the package archives project files and uploads the ZIP to ai.fedin.cn. The archive excludes `.env.local` variants but leaves plain `.env` eligible, so credentials for other services stored there can be sent to the deployment service without explicit consent to transfer those secrets.
AI rationale
The deploy flow can transmit credentials from a project’s plain `.env` file to the package’s deployment service. That credential exposure is separate from the user’s request to deploy project files, so this is malicious credential exfiltration.
Evidence
dist/operations/deploy/deploy.jsdist/tool-handlers/deploy.jscaller-supplied project directory{projectPath}/project-{timestamp}.zip
Network endpoints1
ai.fedin.cn/api/edgeone-pages/deploy
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The deploy archive excludes `.env.local` and `.env.*.local`, but not plain `.env`.
- The deploy tool recursively adds non-excluded project files to a ZIP archive.
- On a deploy request, the ZIP is uploaded to `https://ai.fedin.cn/api/edgeone-pages/deploy`.
- The deploy handler passes the caller-supplied project path to the upload operation.
Evidence against
- Deployment runs only when the user invokes the `deploy` tool; no install lifecycle scripts are declared.
- Uploading project files is part of the package’s stated deployment purpose.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/operations/deploy/deploy.jsView file
5import { join, resolve } from "path";
L6: import axios from "axios";
L7: import FormData from "form-data";
L8: const CONFIG = {
...
L29: try {
L30: const packageJsonPath = join(projectPath, "package.json");
L31: if (existsSync(packageJsonPath)) {
L32: const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
L33: if (packageJson.projectName) {
...
L287: export async function runDeployTool(args) {
L288: const token = args.deployAccessToken ?? process.env.DEPLOY_ACCESS_TOKEN ?? "";
L289: resetConfig(args.path, token);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/operations/deploy/deploy.jsView on unpkg · L55Trigger-reachable chain: scripts.start -> dist/index.js -> dist/tool-handlers/index.js -> dist/tool-handlers/deploy.js -> dist/operations/deploy/deploy.js
L5: import { join, resolve } from "path";
L6: import axios from "axios";
L7: import FormData from "form-data";
L8: const CONFIG = {
...
L29: try {
L30: const packageJsonPath = join(projectPath, "package.json");
L31: if (existsSync(packageJsonPath)) {
L32: const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
L33: if (packageJson.projectName) {
...
L287: export async function runDeployTool(args) {
L288: const token = args.deployAccessToken ?? process.env.DEPLOY_ACCESS_TOKEN ?? "";
L289: resetConfig(args.path, token);
Critical
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/operations/deploy/deploy.js
CriticalTrigger Reachable Dangerous Capabilitydist/operations/deploy/deploy.js
HighTrigger Reachable Credential Exfiltrationdist/operations/deploy/deploy.js
HighAi Review Evidencedist/operations/deploy/deploy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @catchmexz/fedin-vibe-mcp-server-workbuddy@1.9.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @catchmexz/fedin-vibe-mcp-server-workbuddy@1.9.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.