registry / Credential exfiltration / @roarkanalytics/sdk-mcp
@roarkanalytics/sdk-mcp
The official MCP Server for the Roark API
This report shows the evidence for @roarkanalytics/sdk-mcp@3.24.0. 6 of 53 known versions are blocked or flagged. The newest version, 4.32.1, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a concrete default library path that transmits an API credential to an external remote execution service. The absence of install hooks and the safer CLI default do not neutralize that reachable credential-exfiltration path.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
An MCP execute-tool call on a server initialized without mcpOptions.
Impact
A Roark API bearer token and supplied client environment values can be disclosed to api.stainless.com.
Mechanism
Credential forwarding to a remote code-execution endpoint.
Attack narrative
A consumer using the exported server initializer without mcpOptions gets the execute tool in remote mode. When an MCP client invokes that tool, the package obtains the Roark bearer token from the environment or SDK client, combines it with upstream client environment values, and sends the result in a request header to api.stainless.com along with submitted code. The CLI's local default does not remove this unsafe exported-library path.
AI rationale
The package contains a concrete default library path that transmits an API credential to an external remote execution service. The absence of install hooks and the safer CLI default do not neutralize that reachable credential-exfiltration path.
Evidence
src/server.tssrc/code-tool.ts
Network endpoints1
api.stainless.com
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The exported server API enables the execute tool by default and selects the remote Stainless execution mode when no MCP options are supplied.
- The remote execution path collects the Roark bearer token from the environment or SDK client, merges supplied client environment values, and posts them to api.stainless.com.
- The credential-bearing environment object is serialized into an HTTP request header sent with submitted code.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The command-line path defaults to local execution and rejects the retired remote-mode flag, but this does not protect consumers of the exported server API.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourceinstructions.jsView file
•matchType = normalized_sha256
matchedPackage = @roarkanalytics/sdk-mcp@3.19.0
matchedPath = instructions.js
matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.19.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
52Source sends the broad process environment to a literal external destination.
L52: interfaceType: 'PHONE',
L53: recordingUrl: 'https://example.com',
L54: startedAt: 'startedAt',
...
L155: },
L156: body: JSON.stringify({
L157: project_name: 'roark-analytics',
...
L166: }
L167: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L168: }
...
L214: // Check if deno is in PATH
L215: const { execSync, spawn } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L216: try {
Findings
2 Critical8 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limitedcode-tool.js#virtual:normalized:round1
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
HighKnown Malware Source Similaritylocal-docs-search.js
HighPrevious Version Dangerous Deltacode-tool-worker.js
MediumDynamic Requireinstructions.js
Affected versions and remediation
This report applies to @roarkanalytics/sdk-mcp@3.24.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @roarkanalytics/sdk-mcp@3.24.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.