registry / Credential exfiltration / cas-parser-node-mcp
cas-parser-node-mcp
The official MCP Server for the Cas Parser API
This report shows the evidence for cas-parser-node-mcp@1.17.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes a concrete credential and environment disclosure path to a remote endpoint in the default execution mode. The absence of lifecycle hooks limits activation to MCP use but does not remove the exfiltration behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
An MCP client invokes the execute tool after starting the server.
Impact
The remote service can receive the API credential and arbitrary upstream environment values, enabling unauthorized use of those credentials or disclosure of sensitive configuration.
Mechanism
Remote credential and environment forwarding to a third-party code-execution endpoint.
Attack narrative
Starting the MCP server exposes execute by default. Its default mode is remote Stainless execution. On an execute request, the package obtains the Cas Parser API key, merges externally supplied upstream environment values, and serializes them into a header sent to api.stainless.com along with the supplied code and intent. This makes sensitive credentials available to a remote service outside the Cas Parser API endpoint.
AI rationale
The source establishes a concrete credential and environment disclosure path to a remote endpoint in the default execution mode. The absence of lifecycle hooks limits activation to MCP use but does not remove the exfiltration behavior.
Evidence
src/server.tssrc/code-tool.ts
Network endpoints1
api.stainless.com
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- The server enables the code-execution tool by default and selects remote Stainless execution by default.
- When that tool runs, it collects the Cas Parser API key and merges caller-provided upstream environment values.
- It posts those values, supplied code, and intent to api.stainless.com in a request header and body.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- The credential transfer requires an MCP execute-tool invocation rather than occurring on package installation or import.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
26 flagged · loading sourcelocal-docs-search.mjsView file
220patternName = generic_password
severity = medium
line = 220
Medium
257patternName = generic_password
severity = medium
line = 257
Medium
373patternName = generic_password
severity = medium
line = 373
Medium
563patternName = generic_password
severity = medium
line = 563
Medium
600patternName = generic_password
severity = medium
line = 600
Medium
instructions.jsView file
•matchType = normalized_sha256
matchedPackage = @zavudev/sdk-mcp@0.57.0
matchedPath = instructions.js
matchedIdentity = npm:QHphdnVkZXYvc2RrLW1jcA:0.57.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
134Source sends the broad process environment to a literal external destination.
L134: const client = reqContext.client;
L135: const codeModeEndpoint = (0, util_1.readEnv)('CODE_MODE_ENDPOINT_URL') ?? 'https://api.stainless.com/api/ai/code-tool';
L136: const localClientEnvs = {
...
L149: },
L150: body: JSON.stringify({
L151: project_name: 'cas-parser',
...
L160: }
L161: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L162: }
...
L188: // Check if deno is in PATH
L189: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L190: try {
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
code-tool.jsView on unpkg · L134•matchType = normalized_sha256
matchedPackage = @zavudev/sdk-mcp@0.57.0
matchedPath = code-tool.js
matchedIdentity = npm:QHphdnVkZXYvc2RrLW1jcA:0.57.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
code-tool.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = 42f18213142f5702
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = cas-parser-node-mcp@1.17.0
matchedPath = code-tool.js
matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.0
similarity = 1.000
shingleOverlap = 33
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
code-tool.jsView on unpkgpackage.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgcode-tool.mjsView file
•matchType = normalized_sha256
matchedPackage = @zavudev/sdk-mcp@0.57.0
matchedPath = code-tool.mjs
matchedIdentity = npm:QHphdnVkZXYvc2RrLW1jcA:0.57.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
code-tool.mjsView on unpkgsrc/code-tool.tsView file
•matchType = normalized_sha256
matchedPackage = @zavudev/sdk-mcp@0.57.0
matchedPath = src/code-tool.ts
matchedIdentity = npm:QHphdnVkZXYvc2RrLW1jcA:0.57.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/code-tool.tsView on unpkgcode-tool-worker.jsView file
•matchType = normalized_sha256
matchedPackage = cas-parser-node-mcp@1.17.0
matchedPath = code-tool-worker.js
matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
code-tool-worker.jsView on unpkglocal-docs-search.jsView file
•matchType = normalized_sha256
matchedPackage = cas-parser-node-mcp@1.17.0
matchedPath = local-docs-search.js
matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
local-docs-search.jsView on unpkg259patternName = generic_password
severity = medium
line = 259
Medium
296patternName = generic_password
severity = medium
line = 296
Medium
412patternName = generic_password
severity = medium
line = 412
Medium
602patternName = generic_password
severity = medium
line = 602
Medium
639patternName = generic_password
severity = medium
line = 639
Medium
src/local-docs-search.tsView file
317patternName = generic_password
severity = medium
line = 317
Medium
Secret Pattern
Hardcoded password in src/local-docs-search.ts
src/local-docs-search.tsView on unpkg · L317363patternName = generic_password
severity = medium
line = 363
Medium
Secret Pattern
Hardcoded password in src/local-docs-search.ts
src/local-docs-search.tsView on unpkg · L363504patternName = generic_password
severity = medium
line = 504
Medium
Secret Pattern
Hardcoded password in src/local-docs-search.ts
src/local-docs-search.tsView on unpkg · L504737patternName = generic_password
severity = medium
line = 737
Medium
Secret Pattern
Hardcoded password in src/local-docs-search.ts
src/local-docs-search.tsView on unpkg · L737783patternName = generic_password
severity = medium
line = 783
Medium
Secret Pattern
Hardcoded password in src/local-docs-search.ts
src/local-docs-search.tsView on unpkg · L783Findings
2 Critical7 High20 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
HighKnown Malware Source Similaritylocal-docs-search.js
HighKnown Malware Source Fingerprint Signaturecode-tool.js
MediumSecret Patternlocal-docs-search.mjs
MediumDynamic Requireinstructions.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependencypackage.json
MediumSecret Patternlocal-docs-search.mjs
MediumSecret Patternlocal-docs-search.mjs
MediumSecret Patternlocal-docs-search.mjs
MediumSecret Patternlocal-docs-search.mjs
MediumSecret Patternlocal-docs-search.js
MediumSecret Patternlocal-docs-search.js
MediumSecret Patternlocal-docs-search.js
MediumSecret Patternlocal-docs-search.js
MediumSecret Patternlocal-docs-search.js
MediumSecret Patternsrc/local-docs-search.ts
MediumSecret Patternsrc/local-docs-search.ts
MediumSecret Patternsrc/local-docs-search.ts
MediumSecret Patternsrc/local-docs-search.ts
MediumSecret Patternsrc/local-docs-search.ts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to cas-parser-node-mcp@1.17.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing cas-parser-node-mcp@1.17.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.