registry / Credential exfiltration / influship-api-mcp / 0.19.0

influship-api-mcp@0.19.0

The official MCP Server for the Influship API

AI Security Review

scanned 22d ago · by lpm-firewall-ai

The active remote execution path forwards service credentials to an unrestricted configurable destination, meeting the warning threshold for conditional credential exposure. No separate block-eligible malicious behavior was established.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Invoke the execute tool in remote mode after configuring CODE_MODE_ENDPOINT_URL.

Impact

A configured endpoint can receive credentials intended for Influship and potentially use their API permissions.

Mechanism

The remote handler reads the service credential and sends it in the x-stainless-mcp-client-envs request header to the selected endpoint.

AI rationale

Evidence

code-tool.jscode-tool.mjsserver.js

Network endpoints1

api.stainless.com/api/ai/code-tool

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The remote handler selects an unrestricted execution endpoint through CODE_MODE_ENDPOINT_URL.
The handler obtains the Influship API key from the environment or initialized client and merges it into forwarded credentials.
The handler sends those credentials in a POST request header; the ES module implements the same behavior.
The code tool is enabled by default with remote execution, and invoking it activates credential forwarding.

Evidence against

No automatic install lifecycle hook or runtime self-dependency was found.
Remote execution serves the package's API tooling purpose; no covert recipient or malicious intent was established.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 643 KB of source, external domains: api.influship.com, api.stainless.com, bun.sh, cursor.com, deno.land, docs.deno.com, docs.pydantic.dev, docs.python.org, endoflife.date, github.com, img.shields.io, influship.mintlify.app, jsr.io, my.test.proxy.example.com, my.test.server.example.com, npmjs.org, pypi.org, raw.githubusercontent.com, semver.org, vscode.stainless.com, www.github.com, www.npmjs.com, www.python-httpx.org, www.stainless.com, www.tiktok.com, youtube.com

Source & flagged code

10 flagged

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.getInstructions = getInstructions;

8const promises_1 = __importDefault(require("fs/promises"));

9const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

10const util_1 = require("./util.js");

11const INSTRUCTIONS_CACHE_TTL_MS = 15 * 60 * 1000; // 15 minutes

12const instructionsCache = new Map();

13async function getInstructions({ stainlessApiKey, customInstructionsPath, }) {

14 const now = Date.now();

15 const cacheKey = customInstructionsPath ?? stainlessApiKey ?? '';

16 const cached = instructionsCache.get(cacheKey);

17 if (cached && now - cached.fetchedAt <= INSTRUCTIONS_CACHE_TTL_MS) {

18 return cached.fetchedInstructions;

19 }

20 // Evict stale entries so the cache doesn't grow unboundedly.

21 for (const [key, entry] of instructionsCache) {

22 if (now - entry.fetchedAt > INSTRUCTIONS_CACHE_TTL_MS) {

23 instructionsCache.delete(key);

24 }

25 }

26 let fetchedInstructions;

27 if (customInstructionsPath) {

•matchType = normalized_sha256 matchedPackage = plumery-mcp@3.9.0 matchedPath = instructions.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

code-tool.jsView file

Lines 114-154javascript

114 logger.debug('Executing code in local Deno environment');

115 result = await localDenoHandler({ reqContext, args });

116 }

117 else {

118 logger.debug('Executing code in remote Stainless environment');

package.jsonView file

Lines 207-235json

207 "import": "./types.mjs",

208 "require": "./types.js"

209 },

210 "./types.js": {

211 "default": "./types.js"

212 },

213 "./types.mjs"

code-tool.mjsView file

•matchType = normalized_sha256 matchedPackage = cas-parser-node-mcp@1.17.1 matchedPath = code-tool.mjs matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.mjsView on unpkg

src/code-tool.tsView file

•matchType = normalized_sha256 matchedPackage = cas-parser-node-mcp@1.17.1 matchedPath = src/code-tool.ts matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = plumery-mcp@3.9.0 matchedPath = code-tool-worker.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

Source & flagged code

10 flagged · loading source

instructions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

134Source sends the broad process environment to a literal external destination. L134: const client = reqContext.client; L135: const codeModeEndpoint = (0, util_1.readEnv)('CODE_MODE_ENDPOINT_URL') ?? 'https://api.stainless.com/api/ai/code-tool'; L136: const localClientEnvs = { ... L149: }, L150: body: JSON.stringify({ L151: project_name: 'influship-api', ... L160: } L161: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`); L162: } ... L188: // Check if deno is in PATH L189: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process'))); L190: try {

Findings

2 Critical6 High5 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationcode-tool.js

CriticalManifest Confusionpackage.json

HighKnown Malware Source Similaritycode-tool.js

HighKnown Malware Source Similaritycode-tool.mjs

HighKnown Malware Source Similaritysrc/code-tool.ts

HighKnown Malware Source Similaritycode-tool-worker.js

HighKnown Malware Source Similarityinstructions.js

HighPrevious Version Dangerous Deltacode-tool.js

MediumDynamic Requireinstructions.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Medium

Affected versions and remediation

This report applies to influship-api-mcp@0.19.0.

See all versions of influship-api-mcp for other recorded verdicts.

Review the evidence and your use of influship-api-mcp@0.19.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-01 06:39:41.649Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.