Loading npm security reports…

@sdelsad/podcast-tts-server: Malicious npm security report | LPM Firewall

registry / @sdelsad/podcast-tts-server / 1.10.0

@sdelsad/podcast-tts-server@1.10.0

MCP server for Soft Commodity Trading: Gemini TTS, server-side release publishing from npm, and e-mail delivery — the caller never handles bytes

AI Security Review

scanned 27d ago · by lpm-firewall-ai

The server downloads Python programs from a separate npm package selected as latest, then executes them. The scheduled finalization endpoint can activate this chain.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes finalize_episode, or sends a valid request to /finalize?key=SECRET_PATH.

Impact

A compromised or changed toolkit release can execute arbitrary code in the server process, which has cloud storage and optional email credentials.

Mechanism

Runtime download and execution of unpinned remote Python code.

Attack narrative

When finalization runs, the server resolves @sdelsad/commodity-desk-toolkit at latest, downloads its Python files into a temporary directory, and launches them with python3. The feature is exposed as an MCP tool and through a secret-gated HTTP route that hard-codes the latest episode package. A future malicious registry release or supply-chain compromise therefore gains code execution in the deployed server context.

AI rationale

This is an unpinned remote-code-execution supply-chain path, not merely content retrieval. No npm install hook is present, but runtime execution of downloaded latest-version Python is concrete critical attack behavior.

Evidence

server.pytemporary finalize directorybuild_page.pybuild_email.py

Network endpoints2

cdn.jsdelivr.net/npmregistry.npmjs.org/

Decision evidence

Source & flagged code

2 flagged

server.pyView file

Lines 903-943text

903 if not notes:

904 log("no notes in the package: page and e-mail skipped")

905 return json.dumps(report)

906 page_missing = not _blob_exists(f"{safe_show}/{ep}.html")

907 charts_missing = not _blob_exists(f"{safe_show}/{ep}_chart1.png")

908 email_wanted = send_email and RESEND_API_KEY and not (read_meta(safe_show, ep) or {}).get("email_sent")

909 if not (page_missing or charts_missing or email_wanted):

910 log("page, charts and e-mail already done")

911 return json.dumps(report)

912

913 work = tempfile.mkdtemp(prefix="finalize-")

914 try:

915 tk_version = _resolve_version(TOOLKIT_PKG, "latest")

916 for f in TOOLKIT_FILES:

917 open(os.path.join(work, f), "wb").write(_fetch(f"{CDN}/{TOOLKIT_PKG}@{tk_version}/{f}", 5))

918 for f in (notes, "covered.md", "glossary.md"):

919 if f in files:

920 open(os.path.join(work, f), "wb").write(_fetch(f"{base}/{f}", 5))

921 title, dek = item["title"], item["summary"]

922 date = _pretty_date(item["pubdate"])

923 cmd = ["python3", "build_page.py", "--notes", notes, "--number", str(n),

924 "--title", title, "--dek", dek, "--audio-url", audio_url,

925 "--duration", str(duration), "--date", date,

926 "--out", f"{ep}.html", "--charts-prefix", f"{ep}_chart"]

927 r = subprocess.run(cmd, cwd=work, capture_output=True, text=True, timeout=300)

High

Ai Review Evidence

It executes the downloaded build_page.py and build_email.py with Python, allowing a later registry release to run code on the server.

server.pyView on unpkg · L923

928 if r.returncode != 0:

929 report["error"] = f"build_page failed: {r.stderr[-300:]}"

930 return json.dumps(report)

931 charts = sorted(f for f in os.listdir(work) if re.fullmatch(rf"{ep}_chart\d+\.png", f))

932 if page_missing or charts_missing:

933 upload_public(open(os.path.join(work, f"{ep}.html"), "rb").read(),

934 f"{safe_show}/{ep}.html", content_type="text/html; charset=utf-8",

935 cache_control="public, max-age=300")

936 for c in charts:

937 upload_public(open(os.path.join(work, c), "rb").read(), f"{safe_show}/{c}",

938 content_type="image/png", cache_control="public, max-age=86400")

939 log(f"page published with {len(charts)} chart(s): {page_url}")

940 if email_wanted:

941 chart_urls = ",".join(f"https://storage.googleapis.com/{GCS_BUCKET}/{safe_show}/{c}" for c in charts)

942 cmd = ["python3", "build_email.py", "--notes", notes, "--number", str(n),

943 "--title", title, "--dek", dek, "--audio-url", audio_url,

•path = server.py kind = build_helper sizeBytes = 45827 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server.pyView on unpkg