Loading npm security reports…

cas-parser-node-mcp@1.17.1: Malicious npm security report (Block) | LPM Firewall

registry / cas-parser-node-mcp / 1.17.1

cas-parser-node-mcp@1.17.1

The official MCP Server for the Cas Parser API

AI Security Review

scanned 24d ago · by lpm-firewall-ai

The default MCP execute tool forwards Cas Parser credentials and upstream client environment values to a remote Stainless endpoint. It also forwards caller-supplied code and intent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

An MCP client invokes the execute tool after starting the server.

Impact

The remote service can receive the API credential and arbitrary upstream environment values, enabling unauthorized use of those credentials or disclosure of sensitive configuration.

Mechanism

Remote credential and environment forwarding to a third-party code-execution endpoint.

Attack narrative

Starting the MCP server exposes execute by default. Its default mode is remote Stainless execution. On an execute request, the package obtains the Cas Parser API key, merges externally supplied upstream environment values, and serializes them into a header sent to api.stainless.com along with the supplied code and intent. This makes sensitive credentials available to a remote service outside the Cas Parser API endpoint.

AI rationale

The source establishes a concrete credential and environment disclosure path to a remote endpoint in the default execution mode. The absence of lifecycle hooks limits activation to MCP use but does not remove the exfiltration behavior.

Evidence

src/server.tssrc/code-tool.ts

Network endpoints1

api.stainless.com

Decision evidence

Source & flagged code

26 flagged

local-docs-search.mjsView file

Lines 200-277javascript

200 markdown: "## parse\n\n`client.camsKfintech.parse(password?: string, pdf_file?: string, pdf_url?: string): { demat_accounts?: object[]; insurance?: object; investor?: object; meta?: object; mutual_funds?: object[]; nps?: object[]; summary?: object; }`\n\n**post** `/v4/cams_kfintech/parse`\n\nThis endpoint specifically parses CAMS/KFintech CAS (Consolidated Account Statement) PDF files and returns data in a unified format.\nUse this endpoint when you know the PDF is from CAMS or KFintech.\n\n\n### Parameters\n\n- `password?: string`\n Password for the PDF file (if required)\n\n- `pdf_f ...

201 perLanguage: {

202 typescript: {

203 method: 'client.camsKfintech.parse',

204 example: "import CasParser from 'cas-parser-node';\n\nconst client = new CasParser({\n apiKey: process.env['CAS_PARSER_API_KEY'], // This is the default and can be omitted\n});\n\nconst unifiedResponse = await client.camsKfintech.parse();\n\nconsole.log(unifiedResponse.demat_accounts);",

205 },

206 python: {

207 method: 'cams_kfintech.parse',

208 example: 'import os\nfrom cas_parser import CasParser\n\nclient = CasParser(\n api_key=os.environ.get("CAS_PARSER_API_KEY"), # This is the default and can be omitted\n)\nunified_response = client.cams_kfintech.parse()\nprint(unified_response.demat_accounts)',

209 },

210 java: {

211 method: 'camsKfintech().parse',

212 example: 'package com.cas_parser.api.example;\n\nimport com.cas_parser.api.client.CasParserClient;\nimport com.cas_parser.api.client.okhttp.CasParserOkHttpClient;\nimport com.cas_parser.api.models.camskfintech.CamsKfintechParseParams;\nimport com.cas_parser.api.models.camskfintech.UnifiedResponse;\n\npublic final class Main {\n private Main() {}\n\n public static void main(String[] args) {\n CasParserClient client = CasParserOkHttpClient.fromEnv();\n\n UnifiedResponse unifiedResponse = client.camsKfintech().parse();\n }\n}',

213 },

214 go: {

215 method: 'client.CamsKfintech.Parse',

216 example: 'package main\n\nimport (\n\t"context"\n\t"fmt"\n\n\t"github.com/CASParser/cas-parser-go"\n\t"github.com/CASParser/cas-parser-go/option"\n)\n\nfunc main() {\n\tclient := casparser.NewClient(\n\t\toption.WithAPIKey("My API Key"),\n\t)\n\tunifiedResponse, err := client.CamsKfintech.Parse(context.TODO(), casparser.CamsKfintechParseParams{})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}

217 },

218 php: {

219 method: 'camsKfintech->parse',

220 example: "<?php\n\nrequire_once dirname(__DIR__) . '/vendor/autoload.php';\n\n$client = new Client(apiKey: 'My API Key');\n\n$unifiedResponse = $client->camsKfintech->parse(\n password: 'password', pdfFile: 'pdf_file', pdfURL: 'https://example.com'\n);\n\nvar_dump($unifiedResponse);",

Medium

Secret Pattern

Package contains a possible secret pattern.

local-docs-search.mjsView on unpkg · L220

221 },

222 http: {

223 example: "curl https://api.casparser.in/v4/cams_kfintech/parse \\\n -H 'Content-Type: application/json' \\\n -H \"x-api-key: $CAS_PARSER_API_KEY\" \\\n -d '{}'",

224 },

225 },

226 },

227 {

228 name: 'parse_pdf',

229 endpoint: '/v4/cdsl/parse',

230 httpMethod: 'post',

231 summary: 'Parse CDSL CAS PDF',

232 description: 'This endpoint specifically parses CDSL CAS (Consolidated Account Statement) PDF files and returns data in a unified format.\nUse this endpoint when you know the PDF is from CDSL.\n',

233 stainlessPath: '(resource) cdsl > (method) parse_pdf',

234 qualified: 'client.cdsl.parsePdf',

235 params: ['password?: string;', 'pdf_file?: string;', 'pdf_url?: string;'],

236 response: "{ demat_accounts?: { additional_info?: object; bo_id?: string; client_id?: string; demat_type?: 'NSDL' | 'CDSL'; dp_id?: string; dp_name?: string; holdings?: object; linked_holders?: linked_holder[]; value?: number; }[]; insurance?: { life_insurance_policies?: object[]; }; investor?: { address?: string; cas_id?: string; email?: string; mobile?: string; name?: string; pan?: string; pincode?: string; }; meta?: { cas_type?: 'NSDL' | 'CDSL' | 'CAMS_KFINTECH'; generated_at?: string; statement_period?: object; }; mutual_funds?: { additional_info?: object; amc?: string; folio_numbe ...

237 markdown: "## parse_pdf\n\n`client.cdsl.parsePdf(password?: string, pdf_file?: string, pdf_url?: string): { demat_accounts?: object[]; insurance?: object; investor?: object; meta?: object; mutual_funds?: object[]; nps?: object[]; summary?: object; }`\n\n**post** `/v4/cdsl/parse`\n\nThis endpoint specifically parses CDSL CAS (Consolidated Account Statement) PDF files and returns data in a unified format.\nUse this endpoint when you know the PDF is from CDSL.\n\n\n### Parameters\n\n- `password?: string`\n Password for the PDF file (if required)\n\n- `pdf_file?: string`\n Base64 encoded ...

238 perLanguage: {

239 typescript: {

240 method: 'client.cdsl.parsePdf',

241 example: "import CasParser from 'cas-parser-node';\n\nconst client = new CasParser({\n apiKey: process.env['CAS_PARSER_API_KEY'], // This is the default and can be omitted\n});\n\nconst unifiedResponse = await client.cdsl.parsePdf();\n\nconsole.log(unifiedResponse.demat_accounts);",

242 },

243 python: {

244 method: 'cdsl.parse_pdf',

245 example: 'import os\nfrom cas_parser import CasParser\n\nclient = CasParser(\n api_key=os.environ.get("CAS_PARSER_API_KEY"), # This is the default and can be omitted\n)\nunified_response = client.cdsl.parse_pdf()\nprint(unified_response.demat_accounts)',

246 },

247 java: {

248 method: 'cdsl().parsePdf',

249 example: 'package com.cas_parser.api.example;\n\nimport com.cas_parser.api.client.CasParserClient;\nimport com.cas_parser.api.client.okhttp.CasParserOkHttpClient;\nimport com.cas_parser.api.models.camskfintech.UnifiedResponse;\nimport com.cas_parser.api.models.cdsl.CdslParsePdfParams;\n\npublic final class Main {\n private Main() {}\n\n public static void main(String[] args) {\n CasParserClient client = CasParserOkHttpClient.fromEnv();\n\n UnifiedResponse unifiedResponse = client.cdsl().parsePdf();\n }\n}',

250 },

251 go: {

252 method: 'client.Cdsl.ParsePdf',

253 example: 'package main\n\nimport (\n\t"context"\n\t"fmt"\n\n\t"github.com/CASParser/cas-parser-go"\n\t"github.com/CASParser/cas-parser-go/option"\n)\n\nfunc main() {\n\tclient := casparser.NewClient(\n\t\toption.WithAPIKey("My API Key"),\n\t)\n\tunifiedResponse, err := client.Cdsl.ParsePdf(context.TODO(), casparser.CdslParsePdfParams{})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}

254 },

255 php: {

256 method: 'cdsl->parsePdf',

257 example: "<?php\n\nrequire_once dirname(__DIR__) . '/vendor/autoload.php';\n\n$client = new Client(apiKey: 'My API Key');\n\n$unifiedResponse = $client->cdsl->parsePdf(\n password: 'password', pdfFile: 'pdf_file', pdfURL: 'https://example.com'\n);\n\nvar_dump($unifiedResponse);",

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L257

258 },

259 http: {

260 example: "curl https://api.casparser.in/v4/cdsl/parse \\\n -H 'Content-Type: application/json' \\\n -H \"x-api-key: $CAS_PARSER_API_KEY\" \\\n -d '{}'",

261 },

262 },

263 },

264 {

265 name: 'request_otp',

266 endpoint: '/v4/cdsl/fetch',

267 httpMethod: 'post',

268 summary: 'CDSL CAS Fetch - Step 1 (Request OTP)',

269 description: "**Step 1 of 2**: Request OTP for CDSL CAS fetch.\n\nThis endpoint:\n1. Solves reCAPTCHA automatically (~15-20 seconds)\n2. Submits login credentials to CDSL portal\n3. Triggers OTP to user's registered mobile number\n\nAfter user receives OTP, call `/v4/cdsl/fetch/{session_id}/verify` to complete.\n",

270 stainlessPath: '(resource) cdsl.fetch > (method) request_otp',

271 qualified: 'client.cdsl.fetch.requestOtp',

272 params: ['bo_id: string;', 'dob: string;', 'pan: string;'],

273 response: '{ msg?: string; session_id?: string; status?: string; }',

274 markdown: "## request_otp\n\n`client.cdsl.fetch.requestOtp(bo_id: string, dob: string, pan: string): { msg?: string; session_id?: string; status?: string; }`\n\n**post** `/v4/cdsl/fetch`\n\n**Step 1 of 2**: Request OTP for CDSL CAS fetch.\n\nThis endpoint:\n1. Solves reCAPTCHA automatically (~15-20 seconds)\n2. Submits login credentials to CDSL portal\n3. Triggers OTP to user's registered mobile number\n\nAfter user receives OTP, call `/v4/cdsl/fetch/{session_id}/verify` to complete.\n\n\n### Parameters\n\n- `bo_id: string`\n CDSL BO ID (16 digits)\n\n- `dob: string`\n Date of birth ..

275 perLanguage: {

276 typescript: {

277 method: 'client.cdsl.fetch.requestOtp',

Long lines were clipped for display.

Lines 353-393javascript

353 markdown: "## parse\n\n`client.contractNote.parse(broker_type?: 'zerodha' | 'groww' | 'upstox' | 'icici', password?: string, pdf_file?: string, pdf_url?: string): { data?: object; msg?: string; status?: string; }`\n\n**post** `/v4/contract_note/parse`\n\nThis endpoint parses Contract Note PDF files from various brokers including Zerodha, Groww, Upstox, ICICI Securities, and others.\n\n**What is a Contract Note?**\nA contract note is a legal document that provides details of all trades executed by an investor. It includes:\n- Trade details with timestamps, quantities, and prices\n- Brok ...

354 perLanguage: {

355

Lines 543-583javascript

543 markdown: "## parse\n\n`client.nsdl.parse(password?: string, pdf_file?: string, pdf_url?: string): { demat_accounts?: object[]; insurance?: object; investor?: object; meta?: object; mutual_funds?: object[]; nps?: object[]; summary?: object; }`\n\n**post** `/v4/nsdl/parse`\n\nThis endpoint specifically parses NSDL CAS (Consolidated Account Statement) PDF files and returns data in a unified format.\nUse this endpoint when you know the PDF is from NSDL.\n\n\n### Parameters\n\n- `password?: string`\n Password for the PDF file (if required)\n\n- `pdf_file?: string`\n Base64 encoded CAS PD ...

544 perLanguage

600patternName = generic_password severity = medium line = 600

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L600

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule)

code-tool.jsView file

Lines 114-154javascript

114 logger.debug('Executing code in local Deno environment');

115 result = await localDenoHandler({ reqContext, args });

116 }

117 else {

118 logger.debug('Executing code in remote Stainless environment');

package.jsonView file

Lines 207-235json

207 "import": "./types.mjs",

208 "require": "./types.js"

209 },

210 "./types.js": {

211 "default": "./types.js"

212 },

213 "./types.mjs"

code-tool.mjsView file

•matchType = normalized_sha256 matchedPackage = @zavudev/sdk-mcp@0.57.0 matchedPath = code-tool.mjs matchedIdentity = npm:QHphdnVkZXYvc2RrLW1jcA:0.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.mjsView on unpkg

src/code-tool.tsView file

•matchType = normalized_sha256 matchedPackage = @zavudev/sdk-mcp@0.57.0 matchedPath = src/code-tool.ts matchedIdentity = npm:QHphdnVkZXYvc2RrLW1jcA:0.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

•matchType = normalized_sha256 matchedPackage = cas-parser-node-mcp@1.17.0 matchedPath = code-tool-worker.js matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

•matchType = normalized_sha256 matchedPackage = cas-parser-node-mcp@1.17.0 matchedPath = local-docs-search.js matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

local-docs-search.jsView on unpkg

259patternName = generic_password severity = medium line = 259

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L259

296patternName = generic_password severity = medium line = 296

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L296

412patternName = generic_password severity = medium line = 412

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L412

src/local-docs-search.tsView file

317patternName = generic_password severity = medium line = 317

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L317

363patternName = generic_password severity = medium line = 363

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L363

504patternName = generic_password severity = medium line = 504

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L504

737patternName = generic_password severity = medium line = 737

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L737

Source & flagged code

26 flagged · loading source

local-docs-search.mjsView file

220patternName = generic_password severity = medium line = 220

Medium

Secret Pattern

Package contains a possible secret pattern.

local-docs-search.mjsView on unpkg · L220

257patternName = generic_password severity = medium line = 257

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L257

373patternName = generic_password severity = medium line = 373

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L373

563patternName = generic_password severity = medium line = 563

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L563

600patternName = generic_password severity = medium line = 600

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L600

instructions.jsView file

•matchType = normalized_sha256 matchedPackage = @zavudev/sdk-mcp@0.57.0 matchedPath = instructions.js matchedIdentity = npm:QHphdnVkZXYvc2RrLW1jcA:0.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

134Source sends the broad process environment to a literal external destination. L134: const client = reqContext.client; L135: const codeModeEndpoint = (0, util_1.readEnv)('CODE_MODE_ENDPOINT_URL') ?? 'https://api.stainless.com/api/ai/code-tool'; L136: const localClientEnvs = { ... L149: }, L150: body: JSON.stringify({ L151: project_name: 'cas-parser', ... L160: } L161: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`); L162: } ... L188: // Check if deno is in PATH L189: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process'))); L190: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L134

•matchType = normalized_sha256 matchedPackage = @zavudev/sdk-mcp@0.57.0 matchedPath = code-tool.js matchedIdentity = npm:QHphdnVkZXYvc2RrLW1jcA:0.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 42f18213142f5702 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = cas-parser-node-mcp@1.17.0 matchedPath = code-tool.js matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.0 similarity = 1.000 shingleOverlap = 33 summary = package final verdict is malicious

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

code-tool.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.mjsView on unpkg

src/code-tool.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

local-docs-search.jsView on unpkg

259patternName = generic_password severity = medium line = 259

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L259

296patternName = generic_password severity = medium line = 296

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L296

412patternName = generic_password severity = medium line = 412

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L412

src/local-docs-search.tsView file

317patternName = generic_password severity = medium line = 317

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L317

363patternName = generic_password severity = medium line = 363

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L363

504patternName = generic_password severity = medium line = 504

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L504

737patternName = generic_password severity = medium line = 737

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L737

Source & flagged code

26 flagged

local-docs-search.mjsView file

Lines 200-277javascript

201 perLanguage: {

202 typescript: {

203 method: 'client.camsKfintech.parse',

205 },

206 python: {

207 method: 'cams_kfintech.parse',

209 },

210 java: {

211 method: 'camsKfintech().parse',

213 },

214 go: {

215 method: 'client.CamsKfintech.Parse',

217 },

218 php: {

219 method: 'camsKfintech->parse',

Medium

Secret Pattern

Package contains a possible secret pattern.

local-docs-search.mjsView on unpkg · L220

221 },

222 http: {

223 example: "curl https://api.casparser.in/v4/cams_kfintech/parse \\\n -H 'Content-Type: application/json' \\\n -H \"x-api-key: $CAS_PARSER_API_KEY\" \\\n -d '{}'",

224 },

225 },

226 },

227 {

228 name: 'parse_pdf',

229 endpoint: '/v4/cdsl/parse',

230 httpMethod: 'post',

231 summary: 'Parse CDSL CAS PDF',

233 stainlessPath: '(resource) cdsl > (method) parse_pdf',

234 qualified: 'client.cdsl.parsePdf',

235 params: ['password?: string;', 'pdf_file?: string;', 'pdf_url?: string;'],

238 perLanguage: {

239 typescript: {

240 method: 'client.cdsl.parsePdf',

242 },

243 python: {

244 method: 'cdsl.parse_pdf',

246 },

247 java: {

248 method: 'cdsl().parsePdf',

250 },

251 go: {

252 method: 'client.Cdsl.ParsePdf',

254 },

255 php: {

256 method: 'cdsl->parsePdf',

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L257

258 },

259 http: {

260 example: "curl https://api.casparser.in/v4/cdsl/parse \\\n -H 'Content-Type: application/json' \\\n -H \"x-api-key: $CAS_PARSER_API_KEY\" \\\n -d '{}'",

261 },

262 },

263 },

264 {

265 name: 'request_otp',

266 endpoint: '/v4/cdsl/fetch',

267 httpMethod: 'post',

268 summary: 'CDSL CAS Fetch - Step 1 (Request OTP)',

270 stainlessPath: '(resource) cdsl.fetch > (method) request_otp',

271 qualified: 'client.cdsl.fetch.requestOtp',

272 params: ['bo_id: string;', 'dob: string;', 'pan: string;'],

273 response: '{ msg?: string; session_id?: string; status?: string; }',

275 perLanguage: {

276 typescript: {

277 method: 'client.cdsl.fetch.requestOtp',

Long lines were clipped for display.

Lines 353-393javascript

354 perLanguage: {

355

Lines 543-583javascript

544 perLanguage

600patternName = generic_password severity = medium line = 600

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L600

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule)

code-tool.jsView file

Lines 114-154javascript

114 logger.debug('Executing code in local Deno environment');

115 result = await localDenoHandler({ reqContext, args });

116 }

117 else {

118 logger.debug('Executing code in remote Stainless environment');

package.jsonView file

Lines 207-235json

207 "import": "./types.mjs",

208 "require": "./types.js"

209 },

210 "./types.js": {

211 "default": "./types.js"

212 },

213 "./types.mjs"

code-tool.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.mjsView on unpkg

src/code-tool.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

local-docs-search.jsView on unpkg

259patternName = generic_password severity = medium line = 259

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L259

296patternName = generic_password severity = medium line = 296

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L296

412patternName = generic_password severity = medium line = 412

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L412

src/local-docs-search.tsView file

317patternName = generic_password severity = medium line = 317

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L317

363patternName = generic_password severity = medium line = 363

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L363

504patternName = generic_password severity = medium line = 504

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L504

737patternName = generic_password severity = medium line = 737

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L737

cas-parser-node-mcp@1.17.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code