@mgsoftwarebv/mg-dashboard-mcp@7.4.2: Suspicious npm security

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 539 KB of source, external domains: dashboard.mgsoftware.nl

Source & flagged code

3 flagged

dist/index.jsView file

1#!/usr/bin/env node L2: import { spawn } from 'child_process'; L3: import { existsSync, statSync, createReadStream, readFileSync } from 'fs'; ... L9: import { ListToolsRequestSchema, CallToolRequestSchema, isInitializeRequest, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema... L10: import { createServer as createServer$1 } from 'net'; L11: import { Client } from 'ssh2'; L12: import crypto, { randomUUID, createHash, randomBytes, createCipheriv, createDecipheriv } from 'crypto'; L13: import { readFile, mkdtemp, writeFile, rm } from 'fs/promises'; ... L20: import { once } from 'events'; L21: import { lookup } from 'dns/promises'; L22: import { connect } from 'tls'; ... L45: if (!path.startsWith("~")) return path;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.js L1: #!/usr/bin/env node L2: import { spawn } from 'child_process'; L3: import { existsSync, statSync, createReadStream, readFileSync } from 'fs'; ... L9: import { ListToolsRequestSchema, CallToolRequestSchema, isInitializeRequest, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema... L10: import { createServer as createServer$1 } from 'net'; L11: import { Client } from 'ssh2'; L12: import crypto, { randomUUID, createHash, randomBytes, createCipheriv, createDecipheriv } from 'crypto'; L13: import { readFile, mkdtemp, writeFile, rm } from 'fs/promises'; ... L20: import { once } from 'events'; L21: import { lookup } from 'dns/promises'; L22: import { connect } from 'tls'; ... L45: if (!path.startsWith("~")) return path;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

9877patternName = generic_password severity = medium line = 9877 matchedText = mysql --...ord"

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L9877

Source & flagged code

3 flagged · loading source

dist/index.jsView file

1#!/usr/bin/env node L2: import { spawn } from 'child_process'; L3: import { existsSync, statSync, createReadStream, readFileSync } from 'fs'; ... L9: import { ListToolsRequestSchema, CallToolRequestSchema, isInitializeRequest, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema... L10: import { createServer as createServer$1 } from 'net'; L11: import { Client } from 'ssh2'; L12: import crypto, { randomUUID, createHash, randomBytes, createCipheriv, createDecipheriv } from 'crypto'; L13: import { readFile, mkdtemp, writeFile, rm } from 'fs/promises'; ... L20: import { once } from 'events'; L21: import { lookup } from 'dns/promises'; L22: import { connect } from 'tls'; ... L45: if (!path.startsWith("~")) return path;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.js L1: #!/usr/bin/env node L2: import { spawn } from 'child_process'; L3: import { existsSync, statSync, createReadStream, readFileSync } from 'fs'; ... L9: import { ListToolsRequestSchema, CallToolRequestSchema, isInitializeRequest, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema... L10: import { createServer as createServer$1 } from 'net'; L11: import { Client } from 'ssh2'; L12: import crypto, { randomUUID, createHash, randomBytes, createCipheriv, createDecipheriv } from 'crypto'; L13: import { readFile, mkdtemp, writeFile, rm } from 'fs/promises'; ... L20: import { once } from 'events'; L21: import { lookup } from 'dns/promises'; L22: import { connect } from 'tls'; ... L45: if (!path.startsWith("~")) return path;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

9877patternName = generic_password severity = medium line = 9877 matchedText = mysql --...ord"

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L9877

Findings

2 Critical4 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings