plumery-mcp@3.13.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

plumery-mcp@3.13.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

18 flagged · loading source

local-docs-search.mjsView file

4750patternName = generic_password severity = medium line = 4750

Medium

Secret Pattern

Package contains a possible secret pattern.

local-docs-search.mjsView on unpkg · L4750

4754patternName = generic_password severity = medium line = 4754

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L4754

6135patternName = generic_password severity = medium line = 6135

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L6135

6139patternName = generic_password severity = medium line = 6139

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L6139

instructions.jsView file

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

137Source sends the broad process environment to a literal external destination. L137: // Check if deno is in PATH L138: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process'))); L139: try { ... L151: return (0, types_1.asErrorResult)('Deno is required for code execution but was not found. ' + L152: 'Install it from https://deno.land or run: npm install deno'); L153: } ... L187: // with the upstream env vars taking precedence. L188: env: { ...process.env, ...reqContext.upstreamClientEnvs }, L189: }, ... L192: const resp = await new Promise((resolve, reject) => { L193: worker.addEventListener('exit', (exitCode) => { L194: reject(new Error(`Worker exited with code ${exitCode}`));

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L137

•matchType = previous_version_dangerous_delta matchedPackage = plumery-mcp@3.10.0 matchedIdentity = npm:cGx1bWVyeS1tY3A:3.10.0 similarity = 0.596 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

code-tool.jsView on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = plumery-mcp@3.9.0 matchedPath = code-tool-worker.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

4789patternName = generic_password severity = medium line = 4789

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L4789

4793patternName = generic_password severity = medium line = 4793

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L4793

6174patternName = generic_password severity = medium line = 6174

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6174

6178patternName = generic_password severity = medium line = 6178

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6178

src/local-docs-search.tsView file

5588patternName = generic_password severity = medium line = 5588

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L5588

5593patternName = generic_password severity = medium line = 5593

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L5593

7267patternName = generic_password severity = medium line = 7267

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7267

7272patternName = generic_password severity = medium line = 7272

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7272