@roarkanalytics/sdk-mcp@3.6.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

@roarkanalytics/sdk-mcp@3.6.0: Malicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

instructions.jsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@2.34.0 matchedPath = instructions.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:2.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

51Source sends the broad process environment to a literal external destination. L51: interfaceType: 'PHONE', L52: recordingUrl: 'https://example.com', L53: startedAt: 'startedAt', ... L154: }, L155: body: JSON.stringify({ L156: project_name: 'roark-analytics', ... L165: } L166: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`); L167: } ... L193: // Check if deno is in PATH L194: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process'))); L195: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L51

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@2.34.0 matchedPath = code-tool.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:2.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.jsView on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

code-tool.mjsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@2.34.0 matchedPath = code-tool.mjs matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:2.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.mjsView on unpkg

src/code-tool.tsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@2.34.0 matchedPath = src/code-tool.ts matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:2.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@2.34.0 matchedPath = code-tool-worker.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:2.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

Source & flagged code

9 flagged

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.getInstructions = getInstructions;

8const promises_1 = __importDefault(require("fs/promises"));

9const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

10const util_1 = require("./util.js");

11const INSTRUCTIONS_CACHE_TTL_MS = 15 * 60 * 1000; // 15 minutes

12const instructionsCache = new Map();

13async function getInstructions({ stainlessApiKey, customInstructionsPath, }) {

14 const now = Date.now();

15 const cacheKey = customInstructionsPath ?? stainlessApiKey ?? '';

16 const cached = instructionsCache.get(cacheKey);

17 if (cached && now - cached.fetchedAt <= INSTRUCTIONS_CACHE_TTL_MS) {

18 return cached.fetchedInstructions;

19 }

20 // Evict stale entries so the cache doesn't grow unboundedly.

21 for (const [key, entry] of instructionsCache) {

22 if (now - entry.fetchedAt > INSTRUCTIONS_CACHE_TTL_MS) {

23 instructionsCache.delete(key);

24 }

25 }

26 let fetchedInstructions;

27 if (customInstructionsPath) {

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@2.34.0 matchedPath = instructions.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:2.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

code-tool.jsView file

Lines 31-71javascript

31 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !==

package.jsonView file

Lines 1-40json

1{

2 "name": "@roarkanalytics/sdk-mcp",

3 "version": "3.6.0",

4 "description": "The official MCP Server for the Roark API",

5 "author": "Roark <james@roark.ai>",

6

code-tool.mjsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@2.34.0 matchedPath = code-tool.mjs matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:2.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.mjsView on unpkg

src/code-tool.tsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@2.34.0 matchedPath = src/code-tool.ts matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:2.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@2.34.0 matchedPath = code-tool-worker.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:2.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg