registry / Credential exfiltration / sdlc-agent-4-enterprise-server / 1.53.3

sdlc-agent-4-enterprise-server@1.53.3

Code Intelligence MCP Server — multi-agent SDLC pipeline with semantic memory, code graph, and draw.io integration

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The invoked discovery path can send supplied credentials to a package-selected default host, with no recipient-specific validation shown. Since source does not establish that the host is unrelated to the user's Pega service, this supports a warning for conditional credential exposure rather than a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A caller invokes the Pega discovery API with an authorization value and leaves endpoint overrides unset.

Impact

The Pega credential may reach an unintended recipient if the package-defined host is not the user's Pega service.

Mechanism

The route defaults to a package-defined host, passes the authorization value to the discovery client, and the client sends it in an Authorization header.

AI rationale

Evidence

dist/server/routes/pega-api.jsdist/modules/pega/discovery/PegaCodeIntelClient.jsdist/server/HttpServer.js

Network endpoints1

cjpge4gy.pegacea.net/prweb

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Invoking Pega discovery can use the package-defined endpoint when request and environment overrides are absent, and takes authorization from the request or environment.
The discovery client sends that authorization value in an HTTP Authorization header to the selected endpoint.
The Pega routes are mounted under the API prefix; the scanner-targeted test script instead calls a local login endpoint and starts a local indexing check.
A separate rule-fetch route requires caller-provided credentials and an explicit request or environment endpoint. The manifest's prepare command exits immediately.

Evidence against

The transfer requires an explicit Pega discovery API call and a supplied authorization value; source does not establish that the default host is unrelated to the user's Pega service.
The discovery endpoint can be overridden, and source does not show credentials being sent during package installation or import.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVars

Source & flagged code

20 flagged

test-index.cjsView file

Lines 1-35javascript

1const http = require('http');

2function post(url, body, headers) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

test-index.cjsView on unpkg · L1

3 return new Promise((resolve) => {

4 const u = new URL(url);

5 const data = JSON.stringify(body);

6 const req = http.request({ hostname: u.hostname, port: u.port, path: u.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data), ...headers } }, res => {

7 let d = ''; res.on('data', c => d += c); res.on('end', () => resolve({ status: res.statusCode, body: d }));

8 });

9 req.on('error', e => resolve({ status: 0, body: e.message }));

10 req.write(data); req.end();

11 });

12}

13async function run() {

14 // Login

15 const login = await post('http://127.0.0.1:48721/api/admin/auth/login', { username: 'admin', password: 'Admin@123456' });

Medium

Secret Pattern

Package contains a possible secret pattern.

test-index.cjsView on unpkg · L15

16 console.log('Login:', login.status);

17 if (login.status !== 200) { console.log('Login failed:', login.body); return; }

18 const token = JSON.parse(login.body).token;

19 console.log('Token:', token.substring(0, 20) + '...');

21 // Trigger full index

22 const idx = await post('http://127.0.0.1:48721/api/index/full', {}, {

23 'Authorization': 'Bearer ' + token,

24 'X-Project-Id': 'SDLC-Agents-4-Enterprise',

25 'X-Workspace-Root': 'c:\\projects\\kiro\\SDLC-Agents-4-Enterprise'

26 });

27 console.log('POST /api/index/full:', idx.status, idx.body.substring(0, 300));

29 // Wait a bit then check progress

30 await new Promise(r => setTimeout(r, 3000));

31 const prog = await new Promise((resolve) => {

32 const u = new URL('http://127.0.0.1:48721/api/index/progress');

33 http.get({ hostname: u.hostname, port: u.port, path: u.pathname, headers: { 'Authorization': 'Bearer ' + token, 'X-Project-Id': 'SDLC-Agents-4-Enterprise' } }, res => {

34 let d = ''; res.on('data', c => d += c); res.on('end', () => resolve({ status: res.statusCode, body: d }));

35 }).on('error', e => resolve({ status: 0, body: e.message }));

start.jsView file

4import { fileURLToPath } from "url"; L5: import { spawn } from "child_process"; L6: import { randomUUID } from "crypto";

High

Child Process

Package source references child process execution.

start.jsView on unpkg · L4

dist/modules/sandbox/executors/LocalExecutor.jsView file

57return new Promise((resolve) => { L58: // Use `shell: true` so the shell handles command-line quoting natively. L59: // On Windows this invokes cmd.exe (/d /s /c) which correctly interprets

High

Shell

Package source references shell execution.

dist/modules/sandbox/executors/LocalExecutor.jsView on unpkg · L57

•matchType = normalized_sha256 matchedPackage = sdlc-agent-4-enterprise-server@1.53.2 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:1.53.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modules/sandbox/executors/LocalExecutor.jsView on unpkg

dist/viewer/admin/vendor/d3.min.jsView file

1// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock L2: !function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&define.amd?define(["exports"],n):n((t="undefined"!=typeof globalThis?globa...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/viewer/admin/vendor/d3.min.jsView on unpkg · L1

dist/engine/tools/artifact-analyzer/analyzers/FallbackAnalyzer.jsView file

Lines 11-51javascript

11 }

12 analyze(content, _options) {

13 const lines = content.split('\n');

14 const lineCount

dist/viewer/3d-force-graph.min.jsView file

1// Version 1.80.0 3d-force-graph - https://github.com/vasturiano/3d-force-graph L2: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:... L3: // <http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef (WCAG Version 2) L4: // Analyze the 2 colors and returns the color contrast defined by (WCAG Version 2) L5: op.readability=function(e,t){var n=op(e),i=op(t);return(Math.max(n.getLuminance(),i.getLuminance())+.05)/(Math.min(n.getLuminance(),i.getLuminance())+.05)},op.isReadable=function(e...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/viewer/3d-force-graph.min.jsView on unpkg · L1

dist/engine/tools/drawio-renderers.jsView file

1import * as fs from 'fs'; L2: import { execSync } from 'child_process'; L3: let _cachedDrawioCliPath = null; ... L13: const candidates = []; L14: if (process.platform === 'win32') { L15: candidates.push('C:\\Program Files\\draw.io\\draw.io.exe', `${process.env.LOCALAPPDATA || ''}\\Programs\\draw.io\\draw.io.exe`, `${process.env.PROGRAMFILES || ''}\\draw.io\\draw.io... L16: } ... L45: const xml = fs.readFileSync(inputPath, 'utf-8'); L46: const encoded = Buffer.from(xml).toString('base64'); L47: const viewerUrl = `https://viewer.diagrams.net/?lightbox=1&nav=0#R${encoded}`; L48: await orchestrationEngine.executeUpstreamTool('chrome-devtools-mcp', 'navigate_page', {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/engine/tools/drawio-renderers.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = sdlc-agent-4-enterprise-server@1.53.2 matchedPath = dist/engine/tools/drawio-renderers.js matchedIdentity = npm:[redacted]:1.53.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/engine/tools/drawio-renderers.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a1dbdf18f26fb8b1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = sdlc-agent-4-enterprise-server@1.53.2 matchedPath = dist/engine/tools/drawio-renderers.js matchedIdentity = npm:[redacted]:1.53.2 similarity = 1.000 shingleOverlap = 92 summary = package final verdict is malicious

tests/e2e/setup/global-setup.tsView file

48const serverEntry = path.resolve(__dirname, '../../../src/index.ts'); L49: serverProcess = spawn('npx', ['tsx', serverEntry], { L50: cwd: path.resolve(__dirname, '../../..'),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tests/e2e/setup/global-setup.tsView on unpkg · L48

dist/engine/parsers/grammars/tree-sitter-go.wasmView file

•path = [redacted]-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/engine/parsers/grammars/tree-sitter-go.wasmView on unpkg

models/onnx-runtime/generate-identity-model.pyView file

•path = models/onnx-runtime/generate-identity-model.py kind = build_helper sizeBytes = 802 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

models/onnx-runtime/generate-identity-model.pyView on unpkg

servers/fastapi/tests/mocks/normalizers.pyView file

•path = [redacted].py kind = payload_in_excluded_dir sizeBytes = 489 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

servers/fastapi/tests/mocks/normalizers.pyView on unpkg

dist/modules/memory/llm/LLMInitializer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/modules/memory/llm/LLMInitializer.js#virtual:normalized:round1View on unpkg

dist/engine/graph/file-resolver.jsView file

•matchType = normalized_sha256 matchedPackage = sdlc-agent-4-enterprise-server@1.53.2 matchedPath = dist/engine/graph/file-resolver.js matchedIdentity = npm:[redacted]:1.53.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/engine/graph/file-resolver.jsView on unpkg

dist/modules/code-intel/onboarding/WorkspaceAnalyzer.jsView file

•matchType = normalized_sha256 matchedPackage = sdlc-agent-4-enterprise-server@1.53.2 matchedPath = dist/modules/code-[redacted].js matchedIdentity = npm:[redacted]:1.53.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modules/code-intel/onboarding/WorkspaceAnalyzer.jsView on unpkg

dist/modules/security/agentshield/rules/HttpEndpointRule.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modules/security/agentshield/rules/HttpEndpointRule.jsView on unpkg

check-tasks-quick.cjsView file

4patternName = generic_password severity = medium line = 4

Medium

Secret Pattern

Hardcoded password in check-tasks-quick.cjs

check-tasks-quick.cjsView on unpkg · L4

Source & flagged code

20 flagged · loading source

test-index.cjsView file

15patternName = generic_password severity = medium line = 15

Medium

Secret Pattern

Package contains a possible secret pattern.

test-index.cjsView on unpkg · L15

1const http = require('http'); L2: function post(url, body, headers) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

test-index.cjsView on unpkg · L1

start.jsView file

4import { fileURLToPath } from "url"; L5: import { spawn } from "child_process"; L6: import { randomUUID } from "crypto";

High

Child Process

Package source references child process execution.

start.jsView on unpkg · L4

Findings

13 High9 Medium8 Low

HighChild Processstart.js

HighShelldist/modules/sandbox/executors/LocalExecutor.js

HighSame File Env Network Executiondist/viewer/3d-force-graph.min.js

HighSandbox Evasion Gated Capabilitydist/engine/tools/drawio-renderers.js

HighRuntime Package Installtests/e2e/setup/global-setup.ts

HighPayload In Excluded Dirservers/fastapi/tests/mocks/normalizers.py

HighSemantic Analysis Limiteddist/modules/memory/llm/LLMInitializer.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/engine/tools/drawio-renderers.js

HighKnown Malware Source Similaritydist/modules/sandbox/executors/LocalExecutor.js

HighKnown Malware Source Similaritydist/engine/graph/file-resolver.js

Affected versions and remediation

This report applies to sdlc-agent-4-enterprise-server@1.53.3.

See all versions of sdlc-agent-4-enterprise-server for other recorded verdicts.

Review the evidence and your use of sdlc-agent-4-enterprise-server@1.53.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 00:55:07.809Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code