registry / netsuite-supermcp / 0.1.9

netsuite-supermcp@0.1.9

A NetSuite MCP server with OAuth, REST/RESTlet tools, client installers, and account permission probes.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 126 KB of source, external domains: 1234567-sb1.restlets.api.netsuite.com, 1234567-sb1.suitetalk.api.netsuite.com, 127.0.0.1, bun.sh, docs.oracle.com, system.netsuite.com

Source & flagged code

7 flagged

package.jsonView file

Lines 53-93json

53 "bun": ">=1.3.0"

54 },

55 "publishConfig": {

56 "access": "public"

57 },

58 "scripts": {

59 "dev": "bun run --hot src/index.ts",

60 "doctor": "bun run scripts/doctor.ts",

61 "start": "bun run src/index.ts",

62 "stdio": "bun run src/stdio.ts",

63 "oauth:login": "bun run scripts/oauth-login.ts",

64 "setup": "powershell -NoProfile -ExecutionPolicy Bypass -File ./setup.ps1",

65 "setup:wizard": "bun run scripts/setup-wizard.ts",

66 "setup:sh": "sh ./setup.sh",

67 "suitecloud:project": "bun run scripts/suitecloud-project.ts",

68 "install:clients": "bun run scripts/install-clients.ts",

69 "typecheck": "tsc --noEmit",

70 "lint": "biome check .",

71 "format": "biome check --write .",

72 "prepack": "bun run typecheck && bun run lint && bun test && bun run check:restlet-contract",

73 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L73

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L73

74 "test": "bun test",

75 "smoke": "bun run scripts/smoke.ts",

76 "check:restlet-contract": "bun run scripts/check-restlet-contract.ts"

77 },

78 "dependencies": {

79 "@modelcontextprotocol/sdk": "1.29.0",

80 "@types/jsrsasign": "^10.5.15",

81 "hono": "4.12.28",

82 "jsrsasign": "^11.1.3",

83 "ky": "1.14.1",

84 "pino": "10.1.0",

85 "zod": "4.2.1"

86 },

87 "devDependencies": {

88 "@biomejs/biome": "2.3.7",

89 "@types/bun": "1.3.6",

90 "typescript": "5.9.3"

91 }

92}

bin/netsuite-supermcp-install.mjsView file

Lines 1-16javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process"

3import { dirname, join } from "node:path"

High

Child Process

Package source references child process execution.

bin/netsuite-supermcp-install.mjsView on unpkg · L1

4import { fileURLToPath } from "node:url"

6const root

scripts/smoke.tsView file

Lines 1-21typescript

1import { spawn } from "node:child_process"

2import { rm } from "node:fs/promises"

3import { setTimeout as delay } from "node:timers/promises"

4import { z } from "zod"

6const SmokeConfigSchema = z.object({

bin/netsuite-supermcp-setup.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process"

3import { dirname, join } from "node:path"

4import { fileURLToPath } from "node:url"

6const root = dirname(dirname(fileURLToPath(import

scripts/suitecloud-project.tsView file

Lines 37-77typescript

37 await mkdir(objectsDir, { recursive: true })

39 for (const fileName of suiteScriptFiles) {

40 await copyFile(join(suiteScriptSourceDir, fileName), join(scriptsDir, fileName))

41 }

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 1116 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/netsuite-supermcp-install.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process" L3: import { dirname, join } from "node:path"

High

Child Process

Package source references child process execution.

bin/netsuite-supermcp-install.mjsView on unpkg · L1

scripts/smoke.tsView file

1import { spawn } from "node:child_process" L2: import { rm } from "node:fs/promises" ... L6: const SmokeConfigSchema = z.object({ L7: baseUrl: z.string().url().default("http://127.0.0.1:3025"), L8: token: z.string().min(12).default("test-token-12345"), ... L11: const config = SmokeConfigSchema.parse({ L12: baseUrl: process.env["SMOKE_BASE_URL"], L13: token: process.env["MCP_BEARER_TOKEN"],

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/smoke.tsView on unpkg · L1

bin/netsuite-supermcp-setup.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process" L3: import { dirname, join } from "node:path" ... L8: encoding: "utf8", L9: shell: process.platform === "win32", L10: }) ... L12: console.error("NetSuite SuperMCP setup needs Bun.") L13: console.error("Install Bun: https://bun.sh/docs/installation") L14: console.error("Then rerun: netsuite-supermcp setup")

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/netsuite-supermcp-setup.mjsView on unpkg · L1

scripts/suitecloud-project.tsView file

57console.log(` cd ${shellPath(root)}`) L58: console.log(" npx -y @oracle/suitecloud-cli@3.2.0 account:setup -i") L59: console.log(" npx -y @oracle/suitecloud-cli@3.2.0 project:deploy --validate") ... L65: function printJavaPreflight(): void { L66: const java = spawnSync("java", ["-version"], { L67: encoding: "utf8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/suitecloud-project.tsView on unpkg · L57

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 1116 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

Findings

6 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/netsuite-supermcp-install.mjs

HighShell

HighSame File Env Network Executionscripts/smoke.ts

HighSandbox Evasion Gated Capabilitybin/netsuite-supermcp-setup.mjs

HighRuntime Package Installscripts/suitecloud-project.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersetup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 53-93json

53 "bun": ">=1.3.0"

54 },

55 "publishConfig": {

56 "access": "public"

57 },

58 "scripts": {

59 "dev": "bun run --hot src/index.ts",

60 "doctor": "bun run scripts/doctor.ts",

61 "start": "bun run src/index.ts",

62 "stdio": "bun run src/stdio.ts",

63 "oauth:login": "bun run scripts/oauth-login.ts",

64 "setup": "powershell -NoProfile -ExecutionPolicy Bypass -File ./setup.ps1",

65 "setup:wizard": "bun run scripts/setup-wizard.ts",

66 "setup:sh": "sh ./setup.sh",

67 "suitecloud:project": "bun run scripts/suitecloud-project.ts",

68 "install:clients": "bun run scripts/install-clients.ts",

69 "typecheck": "tsc --noEmit",

70 "lint": "biome check .",

71 "format": "biome check --write .",

72 "prepack": "bun run typecheck && bun run lint && bun test && bun run check:restlet-contract",

73 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L73

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L73

74 "test": "bun test",

75 "smoke": "bun run scripts/smoke.ts",

76 "check:restlet-contract": "bun run scripts/check-restlet-contract.ts"

77 },

78 "dependencies": {

79 "@modelcontextprotocol/sdk": "1.29.0",

80 "@types/jsrsasign": "^10.5.15",

81 "hono": "4.12.28",

82 "jsrsasign": "^11.1.3",

83 "ky": "1.14.1",

84 "pino": "10.1.0",

85 "zod": "4.2.1"

86 },

87 "devDependencies": {

88 "@biomejs/biome": "2.3.7",

89 "@types/bun": "1.3.6",

90 "typescript": "5.9.3"

91 }

92}

bin/netsuite-supermcp-install.mjsView file

Lines 1-16javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process"

3import { dirname, join } from "node:path"

High

Child Process

Package source references child process execution.

bin/netsuite-supermcp-install.mjsView on unpkg · L1

4import { fileURLToPath } from "node:url"

6const root

scripts/smoke.tsView file

Lines 1-21typescript

1import { spawn } from "node:child_process"

2import { rm } from "node:fs/promises"

3import { setTimeout as delay } from "node:timers/promises"

4import { z } from "zod"

6const SmokeConfigSchema = z.object({

bin/netsuite-supermcp-setup.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process"

3import { dirname, join } from "node:path"

4import { fileURLToPath } from "node:url"

6const root = dirname(dirname(fileURLToPath(import

scripts/suitecloud-project.tsView file

Lines 37-77typescript

37 await mkdir(objectsDir, { recursive: true })

39 for (const fileName of suiteScriptFiles) {

40 await copyFile(join(suiteScriptSourceDir, fileName), join(scriptsDir, fileName))

41 }

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 1116 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg