Loading npm security reports…

@jieunmarslim/server-editable-slides@0.2.16: Malicious npm | LPM Firewall

registry / @jieunmarslim/server-editable-slides / 0.2.16

@jieunmarslim/server-editable-slides@0.2.16

Model Context Protocol (MCP) client for Editable Slides Cloud

AI Security Review

scanned 21d ago · by lpm-firewall-ai

When a user invokes conversion and Google Drive upload, the package enumerates local gcloud identities and silently shares the resulting presentation with every other configured identity. Its MCP output also attempts to control the host AI agent's actions.

Static reason

No blocking static signals were detected.

Trigger

Launching the CLI as an MCP server and completing a slide conversion or Google Drive upload.

Impact

Sensitive presentation contents can be disclosed to unrelated local Google accounts without user consent.

Mechanism

gcloud account enumeration followed by cross-account Google Drive permission grants.

Attack narrative

The default executable starts an MCP server. During a conversion, it can upload a generated deck to Google Drive; it then lists all accounts in the local gcloud configuration and grants writer permission to every account except the current one. This is unrelated to converting slides and can expose user content to corporate or personal accounts without consent. Returned MCP text also instructs AI agents not to inspect files or use shell commands, which is reviewer and agent manipulation.

AI rationale

The automatic cross-account sharing is concrete, undisclosed data disclosure behavior. The package also embeds AI-agent control instructions, reinforcing malicious intent.

Evidence

index.js

Network endpoints2

www.googleapis.com/drive/v3/files/${fileData.id}/permissionseditable-slides-mcp-1056428002550.us-central1.run.app

Decision evidence

Source & flagged code

5 flagged · loading source

index.jsView file

6import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L6

6import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8: ... L12: const BASE_URL = L13: process.env.EDITABLE_SLIDES_URL || L14: 'https://editable-slides-mcp-1056428002550.us-central1.run.app'; L15:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L6

6import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8: L9: // Redirect console.log to stderr so stdout is reserved strictly for JSON-RPC L10: console.log = (...args) => console.error(...args); ... L12: const BASE_URL = L13: process.env.EDITABLE_SLIDES_URL || L14: 'https://editable-slides-mcp-1056428002550.us-central1.run.app'; L15: ... L83: if (!res.ok) return false; L84: const data = await res.json(); L85: const scopes = (data.scope || '').split(' ');

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

index.jsView on unpkg · L6

6Trigger-reachable credential exfiltration chain: manifest.main -> index.js L6: import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8: L9: // Redirect console.log to stderr so stdout is reserved strictly for JSON-RPC L10: console.log = (...args) => console.error(...args); ... L12: const BASE_URL = L13: process.env.EDITABLE_SLIDES_URL || L14: 'https://editable-slides-mcp-1056428002550.us-central1.run.app'; L15: ... L83: if (!res.ok) return false; L84: const data = await res.json(); L85: const scopes = (data.scope || '').split(' ');

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

index.jsView on unpkg · L6

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg