registry / Credential exfiltration / mcp-biz-method-resolver
mcp-biz-method-resolver
MCP server exposing tools to query and call Genew/rdapp Swagger-based HTTP business services
This report shows the evidence for mcp-biz-method-resolver@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains concrete runtime credential-disclosure and automatic remote logging behavior, plus embedded fallback secrets and global TLS bypass. The absence of install hooks limits the trigger but does not remove the malicious runtime attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
User starts the MCP binary and invokes call_api or semantic_search_api.
Impact
Exposes embedded credentials, permits bearer-token disclosure to arbitrary endpoints, and sends user search metadata to a remote GitLab project.
Mechanism
TLS bypass, authenticated arbitrary-URL forwarding, and automatic GitLab telemetry.
Attack narrative
After a user launches the MCP server, it disables TLS checks and retrieves remote metadata. A caller can invoke call_api with rawUrl; the package first obtains a gateway token, then sends it as Authorization to that supplied URL. Semantic search also creates GitLab issues with query and hit metadata using bundled fallback credentials. These are concrete credential-disclosure and data-egress paths, although none run at npm install time.
AI rationale
The package contains concrete runtime credential-disclosure and automatic remote logging behavior, plus embedded fallback secrets and global TLS bypass. The absence of install hooks limits the trigger but does not remove the malicious runtime attack surface.
Evidence
package.jsondist/web-biz-service-mcp.cjs.cache
Network endpoints3
knowledgeplanet.genew.comnewdev.rdapp.com:9527/auth/api/connect/tokenapi.minimaxi.com/anthropic
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- Runtime disables Node TLS certificate validation.
- MCP call_api accepts arbitrary rawUrl and forwards an authenticated bearer token.
- Semantic searches automatically create GitLab issues containing search metadata.
- Hard-coded fallback credentials/API tokens are embedded in the bundle.
Evidence against
- package.json has only prepublishOnly; no install lifecycle hook.
- Entrypoint starts an MCP stdio server, not during package installation.
- Static eval finding is bundled Bottleneck optional Redis loading, not package payload code.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcedist/web-biz-service-mcp.cjsView file
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/web-biz-service-mcp.cjs:
// node_modules/ajv/dist/compile/codegen/code.js
"node_modules/ajv/dist/compile/codegen/code.js"(exports2) {
// node_modules/ajv/dist/compile/codegen/scope.js
"node_modules/ajv/dist/compile/codegen/scope.js"(exports2) {
// node_modules/ajv/dist/compile/codegen/index.js
"node_modules/ajv/dist/compile/codegen/index.js"(exports2) {
// node_modules/ajv/dist/compile/util.js
"node_modules/ajv/dist/compile/util.js"(exports2) {
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/web-biz-service-mcp.cjsView on unpkg987// validation function arguments
L988: data: new codegen_1.Name("data"),
L989: // data passed to validation function
...
L1812: function resolveUrl(resolver, baseId, id) {
L1813: return id = normalizeId(id), resolver.resolve(baseId, id);
L1814: }
...
L2252: sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`, this.opts.code.process && (sourceCode = this.opts.code.process(sourceCode, sch));
L2253: let validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());
L2254: if (this.scope.value(validateName, { ref: validate }), validate.errors = null, validate.schema = sch.schema, validate.schemaEnv = sch, sch.$async && (validate.$async = !0), this.op...
...
L2381: for (i = 0; i < input.length; i++)
L2382: if (c
High
Findings
2 High3 Medium7 Low
HighEntrypoint Foreign Package Code Overwritedist/web-biz-service-mcp.cjs
HighObfuscated Payload Loaderdist/web-biz-service-mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/web-biz-service-mcp.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to mcp-biz-method-resolver@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing mcp-biz-method-resolver@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.