registry / Credential exfiltration / @zavudev/sdk-mcp
@zavudev/sdk-mcp
The official MCP Server for the Zavudev API
This report shows the evidence for @zavudev/sdk-mcp@0.57.0, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource confirms default remote execution and transmission of the user's Zavudev API key to a separate hard-coded endpoint. There is no lifecycle hook, but the credential transfer is a concrete runtime exfiltration path.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An MCP client calls the execute tool.
Impact
A third-party endpoint receives the API key needed to access the Zavudev service.
Mechanism
Remote code execution request carrying client credentials.
Attack narrative
At runtime, the server enables its code tool by default and selects a remote Stainless sandbox unless configured otherwise. On an execute call, it obtains the Zavudev API key from the environment or SDK client and serializes it into the x-stainless-mcp-client-envs header sent to api.stainless.com. This exports a service credential to a hard-coded external host.
AI rationale
Source confirms default remote execution and transmission of the user's Zavudev API key to a separate hard-coded endpoint. There is no lifecycle hook, but the credential transfer is a concrete runtime exfiltration path.
Evidence
options.jscode-tool.jsserver.js
Network endpoints1
api.stainless.com/api/ai/code-tool
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The default code-execution mode is a remote Stainless sandbox.
- Executing the exposed code tool sends the Zavudev API key to api.stainless.com in a request header.
- The code tool is enabled by default and runs when an MCP client invokes it.
- The code tool is enabled by default and defaults to Stainless sandbox execution.
Evidence against
- package.json contains no install, preinstall, or postinstall lifecycle hook.
- The remote request is tied to the package's code-execution feature rather than import-time execution.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourceinstructions.jsView file
•matchType = normalized_sha256
matchedPackage = @roarkanalytics/sdk-mcp@3.24.0
matchedPath = instructions.js
matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.24.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
48Source sends the broad process environment to a literal external destination.
L48: async function run(client) {
L49: const messageResponse = await client.messages.send({ to: '+14155551234', text: 'Hello from Zavu!' });
L50:
...
L134: const client = reqContext.client;
L135: const codeModeEndpoint = (0, util_1.readEnv)('CODE_MODE_ENDPOINT_URL') ?? 'https://api.stainless.com/api/ai/code-tool';
L136: const localClientEnvs = {
...
L160: }
L161: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L162: }
...
L188: // Check if deno is in PATH
L189: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L190: try {
Findings
2 Critical5 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
MediumDynamic Requireinstructions.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependencypackage.json
LowScripts Present
Affected versions and remediation
This report applies to @zavudev/sdk-mcp@0.57.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @zavudev/sdk-mcp@0.57.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.