registry / Remote code execution / zeronews-mcp
zeronews-mcp
ZeroNews MCP connector (stdio) — wraps the zeronews CLI for Cursor / WorkBuddy
This report shows the evidence for zeronews-mcp@0.1.4. 1 of 3 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe Linux installation path executes an opaque remote shell script from a test mirror with TLS verification disabled. Although reached through an installation tool call, this exposes users to unauthenticated remote code execution.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An MCP client calls install_client while the ZeroNews binary is missing; downloading is enabled by default.
Impact
Downloaded shell code executes with the MCP process’s privileges, and the package cannot verify the script’s integrity or contents.
Mechanism
The package runs curl -SLk against the mirror’s linux/zeronews-install.sh endpoint and pipes the response into sh -s install.
Attack narrative
When installation is requested and the client is absent, the package defaults to downloading a Linux installer script from its hard-coded test environment mirror. It disables TLS verification and pipes the response straight into the shell, allowing unverified remote code to run with the MCP process’s privileges.
AI rationale
The Linux installation path executes an opaque remote shell script from a test mirror with TLS verification disabled. Although reached through an installation tool call, this exposes users to unauthenticated remote code execution.
Evidence
dist/download-zeronews.jsdist/tools/install-client.jsdist/server.js/etc/zeronews/usr/local/bin/zeronews/usr/bin/zeronews
Network endpoints1
agentv2.testenv.waitoin.com:8443/linux/zeronews-install.sh
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- Linux installation uses the default test mirror at agentv2.testenv.waitoin.com:8443.
- The installer fetches a shell script with curl -k and pipes it directly to sh, bypassing TLS certificate verification.
- When the client is missing, install_client downloads by default unless download_install is explicitly false.
Evidence against
- The downloader is reached through MCP installation/setup actions rather than an npm install lifecycle hook. The fetched script’s contents are not included in the package snapshot.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/download-zeronews.jsView file
2import path from "node:path";
L3: import { execFile } from "node:child_process";
L4: import { promisify } from "node:util";
...
L7: /** Override with env `ZERONEWS_DOWNLOAD_BASE` (no trailing slash). Default: test env mirror for MCP install flow. */
L8: export const DEFAULT_DOWNLOAD_BASE = "https://agentv2.testenv.waitoin.com:8443";
L9: export function getDownloadBase() {
L10: const fromEnv = process.env.ZERONEWS_DOWNLOAD_BASE?.trim();
L11: if (fromEnv) {
...
L19: }
L20: export function macosDownloadUrl(cpuArch = process.arch) {
L21: const slug = cpuArch === "arm64" ? "arm" : "amd";
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/download-zeronews.jsView on unpkg · L2•matchType = previous_version_dangerous_delta
matchedPackage = zeronews-mcp@0.1.2
matchedIdentity = npm:emVyb25ld3MtbWNw:0.1.2
similarity = 0.448
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/download-zeronews.jsView on unpkgFindings
4 High3 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/download-zeronews.js
HighPrevious Version Dangerous Deltadist/download-zeronews.js
HighAi Review Evidencedist/download-zeronews.js
HighAi Review Evidencedist/download-zeronews.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to zeronews-mcp@0.1.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing zeronews-mcp@0.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.