registry / @papi-ai/server / 0.7.84
@papi-ai/server@0.7.84
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe reported credential flow uses the PAPI data endpoint, and telemetry is disclosed with an opt-out. The startup network request only checks this package’s version on npm.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Telemetry runs after tool calls unless disabled; the version check runs at startup.
Impact
Routine usage metrics and update availability; no unrelated credential collection or exfiltration was found.
Mechanism
Usage metrics use the configured PAPI data endpoint. The update check requests the latest package version from npm.
AI rationale
The reported credential flow uses the PAPI data endpoint, and telemetry is disclosed with an opt-out. The startup network request only checks this package’s version on npm.
Network endpoints3
guewgygcpcmrcoppihzx.supabase.coregistry.npmjs.orgPAPI_DATA_ENDPOINT (user-configured for self-hosted deployments)
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The README discloses usage telemetry fields and provides the PAPI_TELEMETRY=off opt-out.
- Telemetry sends the PAPI data key to the configured PAPI data endpoint; the self-hosted endpoint must be explicitly configured.
- The startup version check fetches package version metadata from registry.npmjs.org.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/backfill-cycle-metrics.jsView file
231});
L232: import { execFileSync, spawnSync } from "child_process";
L233: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L231dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @papi-ai/server@0.7.85
matchedIdentity = npm:QHBhcGktYWkvc2VydmVy:0.7.85
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
const hostedSupabaseUrl = cleanUrl(env.hostedSupabaseUrl);
dataEndpoint: cleanUrl(env.dataEndpoint) ?? (hostedSupabaseUrl ? `${hostedSupabaseUrl}/functions/v1/data-proxy` : void 0) ?? (selfHosted ? void 0 : `${HOSTED_SUPABASE_URL}/function...
import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
hostedSupabaseUrl: process.env["PAPI_HOSTED_SUPABASE_URL"]
"Authorization": `Bearer ${apiKey}`
"Authorization": `Bearer ${this.apiKey}`
"Authorization": `Bearer ${this.apiKey}`
"Authorization": `Bearer ${this.apiKey}`
Findings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @papi-ai/server@0.7.84.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.84 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.