critical

@koalarx/mcp-server

v1.0.19

MCP Server for Koala Nest Documentation

npmigor.rangelFirst seen Feb 25, 2026Source

Total

Critical

High

Medium

Findings

unknown

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    367: ```
    368: 
>>> 369: Ou no arquivo `.env`:
    370: 
    371: ```env

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    353:       // Validar API Key usando JWT com chave pública
    354:       const publicKey = process.env.JWT_PUBLIC_KEY
>>> 355:         ? Buffer.from(process.env.JWT_PUBLIC_KEY, 'base64')
    356:         : undefined
    357:

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    468:     PassportModule,
    469:     JwtModule.register({
>>> 470:       secret: process.env.JWT_SECRET,
    471:       signOptions: { expiresIn: '1h' },
    472:     }),

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    662: ### Configurar Redis
    663: 
>>> 664: Defina em `.env`:
    665: 
    666: ```env

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1038: 
    1039: ```env
>>> 1040: # .env
    1041: NGROK_AUTH_TOKEN=seu_token_aqui
    1042: ```

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1047: // src/host/main.ts
    1048: await new KoalaApp(app)
>>> 1049:   .useNgrok(process.env.NGROK_AUTH_TOKEN!)
    1050:   .buildAndServe()
    1051: ```

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    172:    # O arquivo .env já foi criado com valores padrão
    173:    # Edite-o conforme necessário
>>> 174:    nano .env
    175:    ```
    176:

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    59: ### 3. Configurar Ambiente
    60: 
>>> 61: Crie um arquivo `.env` na raiz do seu projeto:
    62: 
    63: ```env

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    428: ## Configuração de Ambiente
    429: 
>>> 430: Crie seu `.env`:
    431: 
    432: ```env

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    135:   // Configurar o adapter PostgreSQL antes de criar a aplicação
    136:   const pool = new Pool({
>>> 137:     connectionString: process.env.DATABASE_URL,
    138:   })
    139:   const adapter = new PrismaPg(pool)

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    168: ## Próximos Passos Após Criar o Projeto
    169: 
>>> 170: 1. **Configure as variáveis de ambiente** (.env)
    171:    ```bash
    172:    # O arquivo .env já foi criado com valores padrão

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    123: ```
    124: 
>>> 125: **Nota sobre RedLock:** Os Cron Jobs utilizam `IRedLockService` (que depende de Redis) para garantir que apenas uma instância execute o job simultaneamente em ambientes distribuídos. Certifique-se de configurar a `REDIS_URL` no arquivo `.env` para ambientes com múltiplas instâncias.
    126: 
    127: ## 2. Event Jobs (Handlers de Eventos)

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    352:     try {
    353:       // Validar API Key usando JWT com chave pública
>>> 354:       const publicKey = process.env.JWT_PUBLIC_KEY
    355:         ? Buffer.from(process.env.JWT_PUBLIC_KEY, 'base64')
    356:         : undefined

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    170: 1. **Configure as variáveis de ambiente** (.env)
    171:    ```bash
>>> 172:    # O arquivo .env já foi criado com valores padrão
    173:    # Edite-o conforme necessário
    174:    nano .env

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    98: ## Variáveis de Ambiente
    99: 
>>> 100: O arquivo `.env` é carregado automaticamente pelo Bun:
    101: 
    102: ```bash

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    101: 
    102: ```bash
>>> 103: # .env será carregado automaticamente
    104: DATABASE_URL="postgres://..."
    105: NODE_ENV="development"

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    169:   // Configurar Prisma com adapter PostgreSQL
    170:   const pool = new Pool({
>>> 171:     connectionString: process.env.DATABASE_URL,
    172:   })
    173:   const adapter = new PrismaPg(pool)

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��?j�e�ƭ��ܭ�{�+y�^