npm · neurolink9.61.0

RemediationAI

The CartesiaStream constructor reads CARTESIA_API_KEY from process.env and transmits it directly in WebSocket headers to wss://api.cartesia.ai/tts/websocket, exfiltrating the credential to a third party. Remove the direct environment variable read from the constructor and instead require the API key to be passed as a parameter from the caller, or use a secure credential manager like AWS Secrets Manager or HashiCorp Vault. This ensures credentials are not automatically loaded and transmitted without explicit caller control. Verify by instantiating CartesiaStream without setting CARTESIA_API_KEY in the environment and confirming it requires an explicit key parameter or fails gracefully.

RemediationAI

The GoogleTTSHandler constructor reads GOOGLE_APPLICATION_CREDENTIALS from process.env and passes the service account credentials directly to the Google Cloud TextToSpeechClient, transmitting sensitive credentials to Google Cloud API without caller authorization. Replace the environment variable read with a parameter-based credential injection pattern, or use Application Default Credentials (ADC) with workload identity federation to avoid storing raw credentials in environment variables. This decouples credential loading from module initialization and allows fine-grained access control. Verify by removing GOOGLE_APPLICATION_CREDENTIALS from the environment, instantiating the handler with explicit credentials or ADC, and confirming the client authenticates successfully.

RemediationAI

The CartesiaStream constructor reads CARTESIA_API_KEY from process.env at module load time without any caller identity context, allowing any code that imports the module to use the cached credentials. Refactor to accept the API key as a constructor parameter and validate caller identity via a context object (e.g., userId, requestId, or IAM role) before initializing the WebSocket connection. This ensures each caller is authenticated and authorized before credential use. Verify by passing different caller identities and confirming that unauthorized callers receive an authentication error before any WebSocket connection is attempted.

RemediationAI

The GoogleTTSHandler constructor reads GOOGLE_APPLICATION_CREDENTIALS from process.env and caches a TextToSpeechClient at initialization without consulting caller identity, allowing any importer to invoke the API with the service account. Refactor to accept credentials and caller context as constructor parameters, and validate the caller's identity (e.g., via JWT, service account, or request context) before creating the client. This enforces per-caller authorization. Verify by instantiating the handler with different caller identities and confirming that unauthorized callers receive an authentication error before any Google Cloud API call is made.

RemediationAI

The 'writeJobSummary' tool description does not disclose that it performs a FILESYSTEM side effect (writes job summary to disk). Update the tool's description field to explicitly state: 'This tool writes job summary data to the filesystem (FILESYSTEM side effect).' This ensures callers are aware of persistent state changes. Verify by reading the tool definition and confirming the description includes the FILESYSTEM side effect disclosure.

RemediationAI

The 'installNeurolink' tool description does not disclose that it performs a SUBPROCESS side effect (likely package installation via npm/pnpm/pip). Update the tool's description field to explicitly state: 'This tool installs Neurolink packages by executing package manager commands as subprocesses (SUBPROCESS side effect).' This ensures callers understand the installation behavior and potential side effects. Verify by reading the tool definition and confirming the description includes the SUBPROCESS side effect disclosure.

RemediationAI

The 'writeJobSummary' tool description does not disclose that it performs a FILESYSTEM side effect (writes job summary to disk). Update the tool's description field to explicitly state: 'This tool writes job summary data to the filesystem (FILESYSTEM side effect).' This ensures callers are aware of persistent state changes. Verify by reading the tool definition and confirming the description includes the FILESYSTEM side effect disclosure.

RemediationAI

The 'installNeurolink' tool description does not disclose that it performs a SUBPROCESS side effect (likely package installation via npm/pnpm/pip). Update the tool's description field to explicitly state: 'This tool installs Neurolink packages by executing package manager commands as subprocesses (SUBPROCESS side effect).' This ensures callers understand the installation behavior and potential side effects. Verify by reading the tool definition and confirming the description includes the SUBPROCESS side effect disclosure.

RemediationAI

The postResultComment tool returns untrusted GitHub issue/PR body content (result.response) directly into the comment without any provenance wrapper or sanitization, enabling indirect prompt injection if a malicious issue description contains LLM instructions. Wrap the untrusted content in a clearly marked provenance block (e.g., '``` [GitHub Issue Body - Untrusted Source] {result.response} ```') and sanitize or escape any markdown/code that could be interpreted as instructions. This prevents the injected content from being treated as part of the tool's response. Verify by creating a test issue with prompt injection payloads in the body and confirming the comment displays the content as literal text without executing embedded instructions.

Evidence

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { randomUUID } from "node:crypto";

import { DocsSearch } from "./search.js";

import { createToolDefinitions } from "./tools.js";

import fs from "fs";

import path from "path";

import { fileURLToPath } from "url";

const __dirname = path.dirname(fileURLToPath(import.meta.url));

function resolveIndexPath() {

  const localPath = path.resolve(_

RemediationAI

The MCP server binds an HTTP transport to localhost without any authentication, making it vulnerable to DNS-rebinding attacks where a malicious web page can invoke tools from the user's browser. Switch from HTTP transport to stdio transport by replacing the HttpServerTransport initialization with StdioServerTransport and calling mcp.run(transport) with the stdio transport instead. Stdio transport is not reachable over the network and eliminates DNS-rebinding attack surface. Verify by confirming the server no longer listens on any TCP port and that the MCP client communicates via stdin/stdout.

Evidence

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { randomUUID } from "node:crypto";

import { DocsSearch } from "./search.js";

import { createToolDefinitions } from "./tools.js";

import fs from "fs";

import path from "path";

import { fileURLToPath } from "url";

const __dirname = path.dirname(fileURLToPath(import.meta.url));

function resolveIndexPath() {

  const localPath = path.resolve(_

RemediationAI

The MCP server binds an HTTP transport to localhost without validating the Host header, allowing DNS-rebinding attacks to bypass same-origin checks even if authentication is added. Add host header validation by calling hostHeaderValidation() middleware (requires @modelcontextprotocol/sdk ≥1.24.0) or manually check req.headers.host against an allow-list of expected hostnames (e.g., ['localhost', '127.0.0.1', '[::1]']) before processing requests. This ensures only requests from expected hosts are accepted. Verify by making a request with a spoofed Host header (e.g., 'evil.com') and confirming it is rejected with a 400 or 403 error.

Evidence

"build:cli:link": "pnpm run build:cli && pnpm link --global",

    "cli": "node dist/cli/index.js",

    "preview": "vite preview",

    "prepare": "git rev-parse --git-dir > /dev/null 2>&1 && husky install || echo 'Skipping husky in non-git environment'",

    "prepack": "svelte-kit sync && svelte-package && pnpm run build:react-hooks && pnpm run build:cli && pnpm run build:browser && publint",

    "build:react-hooks": "npx tsc --jsx react-jsx --module nodenext --moduleResolution nodenext --target 

RemediationAI

The package.json declares a 'prepare' hook that runs husky install at install time, executing arbitrary code during npm install without explicit user consent. Remove the 'prepare' script from package.json and instead document that developers should manually run 'husky install' after cloning the repository, or move the hook to a separate optional setup script. This ensures install-time code execution is opt-in rather than automatic. Verify by running 'npm install' in a fresh clone and confirming that husky is not automatically initialized; then confirm that running 'husky install' manually works as expected.