registry / netsuite-supermcp / 0.1.22

netsuite-supermcp@0.1.22

⚠ Under review

A NetSuite MCP server with OAuth, REST/RESTlet tools, client installers, and account permission probes.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 61 file(s), 239 KB of source, external domains: 1234567-sb1.restlets.api.netsuite.com, 1234567-sb1.suitetalk.api.netsuite.com, 127.0.0.1, api.adoptium.net, bin.equinox.io, bun.sh, dashboard.ngrok.com, docs.oracle.com, system.netsuite.com

Source & flagged code

9 flagged

package.jsonView file

Lines 59-99json

59 "access": "public"

60 },

61 "scripts": {

62 "dev": "bun run --hot src/index.ts",

63 "doctor": "bun run scripts/doctor.ts",

64 "start": "bun run src/index.ts",

65 "stdio": "bun run src/stdio.ts",

66 "oauth:login": "bun run scripts/oauth-login.ts",

67 "oauth2": "bun run scripts/oauth2.ts",

68 "public-url": "bun run scripts/public-url.ts",

69 "switch-account": "bun run scripts/switch-account.ts",

70 "setup": "powershell -NoProfile -ExecutionPolicy Bypass -File ./setup.ps1",

71 "setup:wizard": "bun run scripts/setup-wizard.ts",

72 "setup:sh": "sh ./setup.sh",

73 "suitecloud:project": "bun run scripts/suitecloud-project.ts",

74 "install:clients": "bun run scripts/install-clients.ts",

75 "typecheck": "tsc --noEmit",

76 "lint": "biome check .",

77 "format": "biome check --write .",

78 "prepack": "bun run typecheck && bun run lint && bun test && bun run check:restlet-contract",

79 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L79

80 "test": "bun test",

81 "smoke": "bun run scripts/smoke.ts",

82 "probe:live": "bun run scripts/live-tool-probe.ts",

83 "check:restlet-contract": "bun run scripts/check-restlet-contract.ts"

84 },

85 "dependencies": {

86 "@modelcontextprotocol/sdk": "1.29.0",

87 "@types/jsrsasign": "^10.5.15",

88 "hono": "4.12.28",

89 "jsrsasign": "^11.1.3",

90 "ky": "1.14.1",

91 "pino": "10.1.0",

92 "zod": "4.2.1"

93 },

94 "devDependencies": {

95 "@biomejs/biome": "2.3.7",

96 "@types/bun": "1.3.6",

97 "typescript": "5.9.3"

98 }

99}

bin/netsuite-supermcp-switch-account.mjsView file

Lines 1-16javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process"

3import { dirname, join } from "node:path"

High

Child Process

Package source references child process execution.

bin/netsuite-supermcp-switch-account.mjsView on unpkg · L1

4import { fileURLToPath } from "node:url"

6const root

scripts/public-url.tsView file

Lines 234-274typescript

234 return actual.patch >= minimum.patch

235}

236

237function formatVersion(version: NgrokVersion): string {

238 return `${version.major}.${version.minor}.${version

scripts/smoke.tsView file

Lines 1-21typescript

1import { type ChildProcess, spawn } from "node:child_process"

2import { rm } from "node:fs/promises"

3import { setTimeout as delay } from "node:timers/promises"

4import { z } from "zod"

6const SmokeConfigSchema = z.

bin/netsuite-supermcp-setup.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process"

3import { dirname, join } from "node:path"

4import { fileURLToPath } from "node:url"

6const root = dirname(dirname(fileURLToPath(import

scripts/suitecloud-project.tsView file

Lines 46-86typescript

46 }

48 await writeFile(join(root, "manifest.xml"), manifestXml())

49 await writeFile(join(root, "deploy.xml"), deployXml())

50 await writeFile(

51 join

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 1116 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/netsuite-supermcp-switch-account.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process" L3: import { dirname, join } from "node:path"

High

Child Process

Package source references child process execution.

bin/netsuite-supermcp-switch-account.mjsView on unpkg · L1

scripts/public-url.tsView file

254const result = spawnSync( L255: "powershell.exe", L256: [

High

Shell

Package source references shell execution.

scripts/public-url.tsView on unpkg · L254

scripts/smoke.tsView file

1import { type ChildProcess, spawn } from "node:child_process" L2: import { rm } from "node:fs/promises" ... L6: const SmokeConfigSchema = z.object({ L7: baseUrl: z.string().url().default("http://127.0.0.1:3125"), L8: token: z.string().min(12).default("test-token-12345"), ... L11: const config = SmokeConfigSchema.parse({ L12: baseUrl: process.env["SMOKE_BASE_URL"], L13: token: process.env["MCP_BEARER_TOKEN"],

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/smoke.tsView on unpkg · L1

bin/netsuite-supermcp-setup.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process" L3: import { dirname, join } from "node:path" ... L8: encoding: "utf8", L9: shell: process.platform === "win32", L10: }) ... L12: console.error("NetSuite SuperMCP setup needs Bun.") L13: console.error("Install Bun: https://bun.sh/docs/installation") L14: console.error("Then rerun: netsuite-supermcp setup")

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/netsuite-supermcp-setup.mjsView on unpkg · L1

scripts/suitecloud-project.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = netsuite-supermcp@0.1.19 matchedIdentity = npm:bmV0c3VpdGUtc3VwZXJtY3A:0.1.19 similarity = 0.825 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/suitecloud-project.tsView on unpkg

66console.log("") L67: console.log("This uses npx for Oracle SuiteCloud CLI and manages a portable JDK on Windows.") L68: } ... L71: function ensureSuiteCloudJavaEnv(): NodeJS.ProcessEnv { L72: const java = spawnSync("java", ["-version"], { L73: encoding: "utf8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/suitecloud-project.tsView on unpkg · L66

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 1116 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

Findings

1 Critical6 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltascripts/suitecloud-project.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/netsuite-supermcp-switch-account.mjs

HighShellscripts/public-url.ts

HighSame File Env Network Executionscripts/smoke.ts

HighSandbox Evasion Gated Capabilitybin/netsuite-supermcp-setup.mjs

HighRuntime Package Installscripts/suitecloud-project.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersetup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 59-99json

59 "access": "public"

60 },

61 "scripts": {

62 "dev": "bun run --hot src/index.ts",

63 "doctor": "bun run scripts/doctor.ts",

64 "start": "bun run src/index.ts",

65 "stdio": "bun run src/stdio.ts",

66 "oauth:login": "bun run scripts/oauth-login.ts",

67 "oauth2": "bun run scripts/oauth2.ts",

68 "public-url": "bun run scripts/public-url.ts",

69 "switch-account": "bun run scripts/switch-account.ts",

70 "setup": "powershell -NoProfile -ExecutionPolicy Bypass -File ./setup.ps1",

71 "setup:wizard": "bun run scripts/setup-wizard.ts",

72 "setup:sh": "sh ./setup.sh",

73 "suitecloud:project": "bun run scripts/suitecloud-project.ts",

74 "install:clients": "bun run scripts/install-clients.ts",

75 "typecheck": "tsc --noEmit",

76 "lint": "biome check .",

77 "format": "biome check --write .",

78 "prepack": "bun run typecheck && bun run lint && bun test && bun run check:restlet-contract",

79 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L79

80 "test": "bun test",

81 "smoke": "bun run scripts/smoke.ts",

82 "probe:live": "bun run scripts/live-tool-probe.ts",

83 "check:restlet-contract": "bun run scripts/check-restlet-contract.ts"

84 },

85 "dependencies": {

86 "@modelcontextprotocol/sdk": "1.29.0",

87 "@types/jsrsasign": "^10.5.15",

88 "hono": "4.12.28",

89 "jsrsasign": "^11.1.3",

90 "ky": "1.14.1",

91 "pino": "10.1.0",

92 "zod": "4.2.1"

93 },

94 "devDependencies": {

95 "@biomejs/biome": "2.3.7",

96 "@types/bun": "1.3.6",

97 "typescript": "5.9.3"

98 }

99}

bin/netsuite-supermcp-switch-account.mjsView file

Lines 1-16javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process"

3import { dirname, join } from "node:path"

High

Child Process

Package source references child process execution.

bin/netsuite-supermcp-switch-account.mjsView on unpkg · L1

4import { fileURLToPath } from "node:url"

6const root

scripts/public-url.tsView file

Lines 234-274typescript

234 return actual.patch >= minimum.patch

235}

236

237function formatVersion(version: NgrokVersion): string {

238 return `${version.major}.${version.minor}.${version

scripts/smoke.tsView file

Lines 1-21typescript

1import { type ChildProcess, spawn } from "node:child_process"

2import { rm } from "node:fs/promises"

3import { setTimeout as delay } from "node:timers/promises"

4import { z } from "zod"

6const SmokeConfigSchema = z.

bin/netsuite-supermcp-setup.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process"

3import { dirname, join } from "node:path"

4import { fileURLToPath } from "node:url"

6const root = dirname(dirname(fileURLToPath(import

scripts/suitecloud-project.tsView file

Lines 46-86typescript

46 }

48 await writeFile(join(root, "manifest.xml"), manifestXml())

49 await writeFile(join(root, "deploy.xml"), deployXml())

50 await writeFile(

51 join

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 1116 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg