npm · mcp-server-asana1.8.0

Evidence

],

  "scripts": {

    "build": "node build.js",

    "prepare": "npm run build",

    "start": "node dist/index.js",

    "dev": "NODE_ENV=development NODE_OPTIONS='--loader ts-node/esm' node --experimental-specifier-resolution=node src/index.ts",

    "watch": "tsc -w",

RemediationAI

The problem is that the 'prepare' script in package.json runs 'npm run build' automatically whenever the package is installed, executing arbitrary Node.js code (build.js) on every developer's machine and in CI/CD pipelines without explicit consent. Remove the 'prepare' hook from the scripts section in package.json, or if the build output must be distributed, commit the pre-built dist/ folder to version control instead. This eliminates the attack surface where a compromised build.js or its dependencies could execute malicious code during installation. Verify the fix by running 'npm install' in a fresh directory and confirming that build.js does not execute and no dist/ folder is created—only node_modules should be populated.

Evidence

# MCP Server for Asana

[![npm version](https://badge.fury.io/js/%40roychri%2Fmcp-server-asana.svg)](https://www.npmjs.com/package/@roychri/mcp-server-asana)

This Model Context Protocol server implementation of Asana allows you

to talk to Asana API from MCP Client such as Anthropic's Claude

Desktop Application, and many more.

More details on MCP here:

 - https://www.anthropic.com/news/model-context-protocol

 - https://modelcontextprotocol.io/introduction

 - https://github.com/modelcontextproto

RemediationAI

The problem is that the MCP manifest (implicitly defined by the server's tool declarations) does not explicitly document any authentication mechanism, leaving it unclear whether the Asana API calls are protected and how credentials are validated. Add an explicit 'auth' or 'authorization' field to the server's configuration (in README.md, a config schema file, or the server initialization code) that documents the authentication method—for example, 'bearer' for Asana API tokens, 'oauth' if using OAuth2, or 'apiKey' if using API key headers—and specify where credentials are sourced (environment variables, config file, etc.). This allows security reviewers to audit whether credentials are properly validated, transmitted securely, and not logged or exposed. Verify the fix by reviewing the documented auth mechanism against Asana's API security requirements and confirming that a reviewer can trace how credentials flow from the client through the server to the Asana API without ambiguity.