plumery-mcp@3.10.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

plumery-mcp@3.10.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

24 flagged · loading source

local-docs-search.mjsView file

5977patternName = generic_password severity = medium line = 5977

Medium

Secret Pattern

Package contains a possible secret pattern.

local-docs-search.mjsView on unpkg · L5977

5981patternName = generic_password severity = medium line = 5981

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L5981

5985patternName = generic_password severity = medium line = 5985

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L5985

7796patternName = generic_password severity = medium line = 7796

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7796

7800patternName = generic_password severity = medium line = 7800

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7800

7804patternName = generic_password severity = medium line = 7804

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7804

instructions.jsView file

•matchType = normalized_sha256 matchedPackage = cas-parser-node-mcp@1.17.1 matchedPath = instructions.js matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

134Source sends the broad process environment to a literal external destination. L134: const client = reqContext.client; L135: const codeModeEndpoint = (0, util_1.readEnv)('CODE_MODE_ENDPOINT_URL') ?? 'https://api.stainless.com/api/ai/code-tool'; L136: const localClientEnvs = { PLUMERY_BASE_URL: (0, util_1.readEnv)('PLUMERY_BASE_URL') ?? client.baseURL ?? undefined }; ... L146: }, L147: body: JSON.stringify({ L148: project_name: 'plumery', ... L157: } L158: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`); L159: } ... L185: // Check if deno is in PATH L186: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process'))); L187: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L134

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = cas-parser-node-mcp@1.17.1 matchedPath = code-tool-worker.js matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

6016patternName = generic_password severity = medium line = 6016

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6016

6020patternName = generic_password severity = medium line = 6020

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6020

6024patternName = generic_password severity = medium line = 6024

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6024

7835patternName = generic_password severity = medium line = 7835

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L7835

7839patternName = generic_password severity = medium line = 7839

src/local-docs-search.tsView file

7145patternName = generic_password severity = medium line = 7145

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7145

7150patternName = generic_password severity = medium line = 7150

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7150

7155patternName = generic_password severity = medium line = 7155

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7155

9361patternName = generic_password severity = medium line = 9361

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L9361

Source & flagged code

24 flagged

local-docs-search.mjsView file

5977patternName = generic_password severity = medium line = 5977

Medium

Secret Pattern

Package contains a possible secret pattern.

local-docs-search.mjsView on unpkg · L5977

5981patternName = generic_password severity = medium line = 5981

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L5981

5985patternName = generic_password severity = medium line = 5985

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L5985

7796patternName = generic_password severity = medium line = 7796

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7796

7800patternName = generic_password severity = medium line = 7800

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7800

7804patternName = generic_password severity = medium line = 7804

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7804

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule)

code-tool.jsView file

Lines 114-154javascript

114 logger.debug('Executing code in local Deno environment');

115 result = await localDenoHandler({ reqContext, args });

116 }

117 else {

118 logger.debug('Executing code in remote Stainless environment');

package.jsonView file

Lines 1-41json

1{

2 "name": "plumery-mcp",

3 "version": "3.10.0",

4 "description": "The official MCP Server for the Plumery API",

5 "author": "Plumery <alexey.lapusta@plumery.com>",

6

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = cas-parser-node-mcp@1.17.1 matchedPath = code-tool-worker.js matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

6016patternName = generic_password severity = medium line = 6016

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6016

6020patternName = generic_password severity = medium line = 6020

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6020

6024patternName = generic_password severity = medium line = 6024

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6024

7835patternName = generic_password severity = medium line = 7835

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L7835

7839patternName = generic_password severity = medium line = 7839

src/local-docs-search.tsView file

7145patternName = generic_password severity = medium line = 7145

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7145

7150patternName = generic_password severity = medium line = 7150

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7150

7155patternName = generic_password severity = medium line = 7155

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7155

9361patternName = generic_password severity = medium line = 9361

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L9361