registry / infinitecampus-mcp / 2.3.5

infinitecampus-mcp@2.3.5

Infinite Campus (Campus Parent) MCP server — multi-district read + message/document write

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 1.45 MB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.anthropic.com, www.safaribooksonline.com, www.w3.org

Source & flagged code

3 flagged

dist/client.jsView file

Lines 250-290javascript

250 previousDistrictName: currData.name,

251 loggedIntoCampusParent: 'true',

252 }).toString(),

253 });

254 const body = await switchRes.text();

255 if (!body.includes('success')) {

256 console.error(`[ic] CUPS switch to ${linked.districtName} failed: ${body.substring(0, 100)}`);

257 continue;

258 }

259 const switchCookies = parseSetCookies(switchRes.headers);

260 if (!switchCookies.cookieHeader) {

261 console.error(`[ic] CUPS switch to ${linked.districtName}: no cookies`);

262 continue;

263 }

264 // Store synthetic account + session

265 const syntheticAccount = {

266 name: linked.districtName,

267 baseUrl: linkedBaseUrl,

268 district: linked.appName,

269 username: '(linked)',

270 password: '(linked)',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client.jsView on unpkg · L270

271 };

272 this.accounts.set(linked.districtName, syntheticAccount);

273 this.sessions.set(linked.districtName, {

274 cookie: switchCookies.cookieHeader,

275 xsrfToken: switchCookies.xsrfToken,

276 loggedInAt: Date.now(),

277 loginInFlight: null,

278 });

279 this.linkedTo.set(linked.districtName, account.name);

280 console.error(`[ic] Linked district discovered: ${linked.districtName} (${linked.appName})`);

281 }

282 catch (e) {

283 console.error(`[ic] CUPS flow failed for ${linked.districtName}: ${e instanceof Error ? e.message : e}`);

284 }

285 }

286 }

287 catch (e) {

288 // Don't fail primary login on linked-district errors

289 console.error(`[ic] Linked district discovery failed: ${e instanceof Error ? e.message : e}`);

290 }

dist/bundle.jsView file

38548patternName = generic_password severity = medium line = 38548 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/bundle.js

dist/bundle.jsView on unpkg · L38548

2952sourceCode = this.opts.code.process(sourceCode, sch); L2953: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2954: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bundle.jsView on unpkg · L2952

Source & flagged code

3 flagged · loading source

dist/client.jsView file

270patternName = generic_password severity = medium line = 270 matchedText = password...d)',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client.jsView on unpkg · L270

dist/bundle.jsView file

38548patternName = generic_password severity = medium line = 38548 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/bundle.js

dist/bundle.jsView on unpkg · L38548

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bundle.jsView on unpkg · L2952

Findings

4 Medium5 Low

MediumSecret Patterndist/client.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/bundle.js

LowScripts Present

LowEvaldist/bundle.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/client.jsView file

Lines 250-290javascript

250 previousDistrictName: currData.name,

251 loggedIntoCampusParent: 'true',

252 }).toString(),

253 });

254 const body = await switchRes.text();

255 if (!body.includes('success')) {

256 console.error(`[ic] CUPS switch to ${linked.districtName} failed: ${body.substring(0, 100)}`);

257 continue;

258 }

259 const switchCookies = parseSetCookies(switchRes.headers);

260 if (!switchCookies.cookieHeader) {

261 console.error(`[ic] CUPS switch to ${linked.districtName}: no cookies`);

262 continue;

263 }

264 // Store synthetic account + session

265 const syntheticAccount = {

266 name: linked.districtName,

267 baseUrl: linkedBaseUrl,

268 district: linked.appName,

269 username: '(linked)',

270 password: '(linked)',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client.jsView on unpkg · L270

271 };

272 this.accounts.set(linked.districtName, syntheticAccount);

273 this.sessions.set(linked.districtName, {

274 cookie: switchCookies.cookieHeader,

275 xsrfToken: switchCookies.xsrfToken,

276 loggedInAt: Date.now(),

277 loginInFlight: null,

278 });

279 this.linkedTo.set(linked.districtName, account.name);

280 console.error(`[ic] Linked district discovered: ${linked.districtName} (${linked.appName})`);

281 }

282 catch (e) {

283 console.error(`[ic] CUPS flow failed for ${linked.districtName}: ${e instanceof Error ? e.message : e}`);

284 }

285 }

286 }

287 catch (e) {

288 // Don't fail primary login on linked-district errors

289 console.error(`[ic] Linked district discovery failed: ${e instanceof Error ? e.message : e}`);

290 }

dist/bundle.jsView file

38548patternName = generic_password severity = medium line = 38548 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/bundle.js

dist/bundle.jsView on unpkg · L38548

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bundle.jsView on unpkg · L2952