registry / alexa-mcp / 0.4.4

alexa-mcp@0.4.4

MCP server and CLI for Alexa devices and smart home control

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 137 KB of source, external domains: 127.0.0.1, alexa.amazon.co.uk, alexa.amazon.com, alexa.amazon.de, api.amazon.com, api.ipify.org, eu-api-alexa.amazon.co.uk, eu-api-alexa.amazon.de, internal.amazon.com, na-api-alexa.amazon.com

Source & flagged code

4 flagged

package.jsonView file

Lines 1-32json

2 "name": "alexa-mcp",

3 "version": "0.4.4",

4 "description": "MCP server and CLI for Alexa devices and smart home control",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "alexa-mcp": "dist/cli.js"

9 },

10 "scripts": {

11 "build": "tsc",

12 "postinstall": "patch-package",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 "prepare": "npm run build",

14 "start": "node dist/index.js",

15 "cli": "node dist/cli.js",

16 "lint": "eslint .",

17 "lint:fix": "eslint . --fix",

18 "test": "vitest run",

19 "test:watch": "vitest",

20 "test:integration": "TEST_INTEGRATION=1 vitest run",

21 "test:e2e": "TEST_INTEGRATION=1 vitest run test/e2e.test.ts",

22 "test:e2e:devices": "TEST_INTEGRATION=1 vitest run test/e2e-devices.test.ts"

23 },

24 "keywords": [

25 "alexa",

26 "mcp",

27 "smart-home",

28 "echo",

29 "model-context-protocol"

30 ],

31 "author": "m0nkmaster",

32 "license": "MIT",

dist/tunnel.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2const PROXY_PORT = 8080;

High

Child Process

Package source references child process execution.

dist/tunnel.jsView on unpkg · L1

3export async function startTunnel(port = PROXY_PORT) {

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = patch-package

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = patch-package

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/tunnel.jsView file

1import { spawn } from "node:child_process"; L2: const PROXY_PORT = 8080;

High

Child Process

Package source references child process execution.

dist/tunnel.jsView on unpkg · L1

57let resolved = false; L58: const proc = spawn("npx", ["-y", "localtunnel", "--port", String(port)], { L59: stdio: ["ignore", "pipe", "pipe"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/tunnel.jsView on unpkg · L57

Findings

4 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/tunnel.js

HighShell

HighRuntime Package Installdist/tunnel.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 1-32json

2 "name": "alexa-mcp",

3 "version": "0.4.4",

4 "description": "MCP server and CLI for Alexa devices and smart home control",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "alexa-mcp": "dist/cli.js"

9 },

10 "scripts": {

11 "build": "tsc",

12 "postinstall": "patch-package",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 "prepare": "npm run build",

14 "start": "node dist/index.js",

15 "cli": "node dist/cli.js",

16 "lint": "eslint .",

17 "lint:fix": "eslint . --fix",

18 "test": "vitest run",

19 "test:watch": "vitest",

20 "test:integration": "TEST_INTEGRATION=1 vitest run",

21 "test:e2e": "TEST_INTEGRATION=1 vitest run test/e2e.test.ts",

22 "test:e2e:devices": "TEST_INTEGRATION=1 vitest run test/e2e-devices.test.ts"

23 },

24 "keywords": [

25 "alexa",

26 "mcp",

27 "smart-home",

28 "echo",

29 "model-context-protocol"

30 ],

31 "author": "m0nkmaster",

32 "license": "MIT",

dist/tunnel.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2const PROXY_PORT = 8080;

High

Child Process

Package source references child process execution.

dist/tunnel.jsView on unpkg · L1

3export async function startTunnel(port = PROXY_PORT) {

Lines 37-77javascript

37 resolve(null);

38 }

39 });

40 proc.on("exit", (code) => {

41 if (!resolved && code !== 0 && code !== null) {

42 resolved = true;

43 resolve(null);

44 }

45 });

46 setTimeout(() => {

47 if (!resolved) {

48 resolved = true;

49 proc.kill("SIGTERM");

50 resolve(null);

51 }

52 }, 12000);

53 });

54}

55async function tryLocaltunnel(port) {

56 return new Promise((resolve) => {

57 let resolved = false;

58 const proc = spawn("npx", ["-y", "localtunnel", "--port", String(port)], {

59 stdio: ["ignore", "pipe", "pipe"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/tunnel.jsView on unpkg · L57

60 });

61 const check = (data) => {

62 const m = data.match(/https:\/\/([a-z0-9-]+\.(?:loca\.lt|localtunnel\.me))/);

63 if (m && !resolved) {

64 resolved = true;

65 const url = m[0].trim();

66 const host = m[1];

67 resolve({ url, host, close: () => proc.kill("SIGTERM") });

68 }

69 };

70 let buf = "";

71 proc.stdout?.on("data", (chunk) => {

72 buf += chunk.toString();

73 check(buf);

74 });

75 proc.stderr?.on("data", (chunk) => {

76 buf += chunk.toString();

77 check(buf);