Loading npm security reports…

@trustbaseai/collab-mcp@0.13.1: Clean npm security report (Allow) | LPM Firewall

registry / @trustbaseai/collab-mcp / 0.13.1

@trustbaseai/collab-mcp@0.13.1

Multi-AI collaboration MCP server - core communication layer

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis completed at 94.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 159 KB of source, external domains: 127.0.0.1, www.launchd.info

Source & flagged code

4 flagged

src/cli-install.jsView file

Lines 94-134javascript

94 } else {

95 try {

96 const u = await prompt('Admin username [admin]: ');

97 username = (u || 'admin').trim();

98 password = await prompt('Admin password (empty = random): ');

99 } catch (_) {

100 // readline blew up (rare); fall back to random

101 password = crypto.randomBytes(16).toString('base64url');

102 console.log('✓ Interactive prompt failed → generated random admin password');

103 }

104 if (!password) {

105 password = crypto.randomBytes(16).toString('base64url');

106 console.log('✓ Generated random admin password');

107 }

108 }

109

110 try {

111 const hash = await auth.hashPassword(password);

112 db.createUser({ username, password_hash: hash, role: 'admin' });

113 console.log('✓ Created admin user: ' + username);

114 console.log(' password: ' + password);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/cli-install.jsView on unpkg · L114

115 console.log(' (change with: collab-mcp user passwd ' + username + ')');

116 } catch (e) {

117 console.error('✗ Failed to create admin user:', e.message);

118 db.close();

119 return 1;

120 }

121 }

122

123 // 5. Admin API key (DB-backed, replaces Phase 1 configStore.api_keys.admin)

124 const existingAdminKeys = db.listApiKeys().filter((k) => k.name === 'admin' && !k.revoked);

125 if (existingAdminKeys.length > 0) {

126 console.log('• admin API key already exists (use `collab-mcp keys list` to view)');

127 } else {

128 const id = 'cmcp_' + crypto.randomBytes(16).toString('hex');

129 const secret = crypto.randomBytes(32).toString('base64url');

130 const hash = await auth.hashPassword(secret);

131 try {

132 db.createApiKey({

133 id,

134 name: 'admin',

src/service-windows.jsView file

Lines 1-32javascript

1'use strict';

3/**

4 * service-windows.js - Windows service installer

5 *

6 * Strategy:

7 * 1. Write a .bat wrapper at ~/.collab-mcp/bin/service-start.bat

8 * 2. Try sc.exe create (requires admin). If that fails, fall back to a

9 * Logon-triggered Scheduled Task (no admin required).

10 * 3. uninstall() removes both, in case the user switched modes.

src/cli-user.jsView file

Lines 43-113javascript

43 console.error('Usage: collab-mcp user create <username> [role]');

44 return 1;

45 }

46 const role = args[1] || 'user';

Source & flagged code

4 flagged · loading source

src/cli-install.jsView file

114

Source & flagged code

4 flagged

src/cli-install.jsView file

Lines 94-134javascript

94 } else {

95 try {

96 const u = await prompt('Admin username [admin]: ');

97 username = (u || 'admin').trim();

98 password = await prompt('Admin password (empty = random): ');

99 } catch (_) {

100 // readline blew up (rare); fall back to random

101 password = crypto.randomBytes(16).toString('base64url');

102 console.log('✓ Interactive prompt failed → generated random admin password');

103 }

104 if (!password) {

105 password = crypto.randomBytes(16).toString('base64url');

106 console.log('✓ Generated random admin password');

107 }

108 }

109

110 try {

111 const hash = await auth.hashPassword(password);

112 db.createUser({ username, password_hash: hash, role: 'admin' });

113 console.log('✓ Created admin user: ' + username);

114 console.log(' password: ' + password);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/cli-install.jsView on unpkg · L114

115 console.log(' (change with: collab-mcp user passwd ' + username + ')');

116 } catch (e) {

117 console.error('✗ Failed to create admin user:', e.message);

118 db.close();

119 return 1;

120 }

121 }

122

123 // 5. Admin API key (DB-backed, replaces Phase 1 configStore.api_keys.admin)

124 const existingAdminKeys = db.listApiKeys().filter((k) => k.name === 'admin' && !k.revoked);

125 if (existingAdminKeys.length > 0) {

126 console.log('• admin API key already exists (use `collab-mcp keys list` to view)');

127 } else {

128 const id = 'cmcp_' + crypto.randomBytes(16).toString('hex');

129 const secret = crypto.randomBytes(32).toString('base64url');

130 const hash = await auth.hashPassword(secret);

131 try {

132 db.createApiKey({

133 id,

134 name: 'admin',

src/service-windows.jsView file

Lines 1-32javascript

1'use strict';

3/**

4 * service-windows.js - Windows service installer

5 *

6 * Strategy:

7 * 1. Write a .bat wrapper at ~/.collab-mcp/bin/service-start.bat

8 * 2. Try sc.exe create (requires admin). If that fails, fall back to a

9 * Logon-triggered Scheduled Task (no admin required).

10 * 3. uninstall() removes both, in case the user switched modes.

src/cli-user.jsView file

Lines 43-113javascript

43 console.error('Usage: collab-mcp user create <username> [role]');

44 return 1;

45 }

46 const role = args[1] || 'user';

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code