ICUICU
critical

@line/line-bot-mcp-server

v0.4.2

MCP server for interacting with your LINE Official Account

npmGitHub ActionsFirst seen Feb 22, 2026

17

Total

5

Critical

12

High

0

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    60: new CreateRichMenu(messagingApiClient, lineBlobClient).register(server);
    61: async function main() {
>>> 62:     if (!process.env.CHANNEL_ACCESS_TOKEN) {
    63:         console.error("Please set CHANNEL_ACCESS_TOKEN");
    64:         process.exit(1);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    105:     // 5. Delete the temporary HTML file
    106:     const richMenuImagePath = path.join(os.tmpdir(), `template-0${templateNo}-${Date.now()}.png`);
>>> 107:     const serverPath = process.env.SERVER_PATH || path.resolve(__dirname, "..", "..");
    108:     // 1. Read the Markdown template
    109:     const srcPath = path.join(serverPath, `richmenu-template/template-0${templateNo}.md`);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    150:     const browser = await puppeteer.launch({
    151:         headless: true,
>>> 152:         executablePath: process.env.PUPPETEER_EXECUTABLE_PATH || undefined,
    153:         args: [
    154:             "--no-sandbox",
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    34:     version: LINE_BOT_MCP_SERVER_VERSION,
    35: });
>>> 36: const channelAccessToken = process.env.CHANNEL_ACCESS_TOKEN || "";
    37: const destinationId = process.env.DESTINATION_USER_ID || "";
    38: const messagingApiClient = new line.messagingApi.MessagingApiClient({
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    35: });
    36: const channelAccessToken = process.env.CHANNEL_ACCESS_TOKEN || "";
>>> 37: const destinationId = process.env.DESTINATION_USER_ID || "";
    38: const messagingApiClient = new line.messagingApi.MessagingApiClient({
    39:     channelAccessToken: channelAccessToken,
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��?�'�Ǭ��Ԅ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��(���jw���ǧ�7�j�m

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �uƬ�7��Ǭ��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �uƬ�Y^�Ǭ��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �uƬ�7��Ǭ��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �uƬ�Y^�Ǭ��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r����br��ڭ��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r����br��ڭ��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r����br��ڭ��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: V,�ek ���,��+

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 25, 2026critical17
Feb 23, 2026critical17
Feb 22, 2026critical17