Loading npm security reports…

plumery-mcp@3.9.0: Malicious npm security report (Block) | LPM Firewall

registry / plumery-mcp / 3.9.0

plumery-mcp@3.9.0

The official MCP Server for the Plumery API

AI Security Review

scanned 22d ago · by lpm-firewall-ai

The default MCP execute capability sends code and runtime authentication-related data to a third-party remote execution endpoint. This creates a concrete credential and data disclosure path whenever the tool is used.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

An MCP client invokes the enabled execute tool.

Impact

A third party can receive a Plumery session value, client environment metadata, and code supplied to the tool.

Mechanism

Remote submission of code, environment metadata, authorization, and session data.

Attack narrative

The server exposes execute by default and selects a remote Stainless sandbox by default. When an MCP client invokes that tool, the package posts the supplied code and intent to api.stainless.com. The same request includes merged client environment metadata, an optional authorization value, and the PLUMERY_SESSION value read from the runtime environment. This transfers credentials and potentially sensitive execution content to an external service rather than keeping execution within the configured Plumery client boundary.

AI rationale

The package contains a default-enabled remote execution path that transmits a runtime session value and request data to a hard-coded external endpoint. This is concrete credential and data exfiltration behavior, despite not running during installation.

Evidence

src/options.tssrc/server.tssrc/code-tool.tssrc/util.tscode-tool.js

Network endpoints1

Source & flagged code

25 flagged · loading source

local-docs-search.mjsView file

5973patternName = generic_password severity = medium line = 5973

Medium

Secret Pattern

Package contains a possible secret pattern.

local-docs-search.mjsView on unpkg · L5973

5977patternName = generic_password severity = medium line = 5977

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L5977

5981patternName = generic_password severity = medium line = 5981

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L5981

7836patternName = generic_password severity = medium line = 7836

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7836

7840patternName = generic_password severity = medium line = 7840

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7840

7844patternName = generic_password severity = medium line = 7844

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7844

instructions.jsView file

•matchType = normalized_sha256 matchedPackage = cas-parser-node-mcp@1.17.1 matchedPath = instructions.js matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

134Source sends the broad process environment to a literal external destination. L134: const client = reqContext.client; L135: const codeModeEndpoint = (0, util_1.readEnv)('CODE_MODE_ENDPOINT_URL') ?? 'https://api.stainless.com/api/ai/code-tool'; L136: const localClientEnvs = { PLUMERY_BASE_URL: (0, util_1.readEnv)('PLUMERY_BASE_URL') ?? client.baseURL ?? undefined }; ... L146: }, L147: body: JSON.stringify({ L148: project_name: 'plumery', ... L157: } L158: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`); L159: } ... L185: // Check if deno is in PATH L186: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process'))); L187: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L134

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = cas-parser-node-mcp@1.17.1 matchedPath = code-tool-worker.js matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = plumery-mcp@3.10.0 matchedIdentity = npm:cGx1bWVyeS1tY3A:3.10.0 similarity = 0.885 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

6012patternName = generic_password severity = medium line = 6012

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6012

6016patternName = generic_password severity = medium line = 6016

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6016

6020patternName = generic_password severity = medium line = 6020

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6020

7875patternName = generic_password severity = medium line = 7875

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L7875

7879patternName = generic_password severity = medium line = 7879

src/local-docs-search.tsView file

7141patternName = generic_password severity = medium line = 7141

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7141

7146patternName = generic_password severity = medium line = 7146

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7146

7151patternName = generic_password severity = medium line = 7151

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7151

9411patternName = generic_password severity = medium line = 9411

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L9411

9416

Source & flagged code

25 flagged

local-docs-search.mjsView file

5973patternName = generic_password severity = medium line = 5973

Medium

Secret Pattern

Package contains a possible secret pattern.

local-docs-search.mjsView on unpkg · L5973

5977patternName = generic_password severity = medium line = 5977

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L5977

5981patternName = generic_password severity = medium line = 5981

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L5981

7836patternName = generic_password severity = medium line = 7836

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7836

7840patternName = generic_password severity = medium line = 7840

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7840

7844patternName = generic_password severity = medium line = 7844

Medium

Secret Pattern

Hardcoded password in local-docs-search.mjs

local-docs-search.mjsView on unpkg · L7844

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule)

code-tool.jsView file

Lines 114-154javascript

114 logger.debug('Executing code in local Deno environment');

115 result = await localDenoHandler({ reqContext, args });

116 }

117 else {

118 logger.debug('Executing code in remote Stainless environment');

package.jsonView file

Lines 1-41json

1{

2 "name": "plumery-mcp",

3 "version": "3.9.0",

4 "description": "The official MCP Server for the Plumery API",

5 "author": "Plumery <alexey.lapusta@plumery.com>",

6

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = cas-parser-node-mcp@1.17.1 matchedPath = code-tool-worker.js matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = plumery-mcp@3.10.0 matchedIdentity = npm:cGx1bWVyeS1tY3A:3.10.0 similarity = 0.885 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

6012patternName = generic_password severity = medium line = 6012

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6012

6016patternName = generic_password severity = medium line = 6016

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6016

6020patternName = generic_password severity = medium line = 6020

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L6020

7875patternName = generic_password severity = medium line = 7875

Medium

Secret Pattern

Hardcoded password in local-docs-search.js

local-docs-search.jsView on unpkg · L7875

7879patternName = generic_password severity = medium line = 7879

src/local-docs-search.tsView file

7141patternName = generic_password severity = medium line = 7141

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7141

7146patternName = generic_password severity = medium line = 7146

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7146

7151patternName = generic_password severity = medium line = 7151

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L7151

9411patternName = generic_password severity = medium line = 9411

Medium

Secret Pattern

Hardcoded password in src/local-docs-search.ts

src/local-docs-search.tsView on unpkg · L9411

9416