mcp-adr-analysis-server

# SECURITY INCIDENT RESPONSE - 2025-09-08 ## Critical Security Advisory **IMMEDIATE ACTION REQUIRED**: Multiple npm packages have been compromised with malware. ### Affected Packages - `color-convert` - ALL versions compromised with malware (GHSA-ch7m-m9rf-8gvv) - `color-name` - ALL versions compromised with malware (GHSA-m99c-cfww-cxqx) - `debug` - ALL versions compromised with malware (GHSA-8mgj-vmr8-frr6) - `error-ex` - ALL versions compromised with malware (GHSA-5g7q-qh7p-jjvm) - `is-arrayish` - ALL versions compromised with malware (GHSA-hfm8-9jrf-7g9w) ### Current Status (2025-09-08 17:10 UTC) #### ✅ COMPLETED - Removed Jest 30.x and all test-related dependencies (primary source of vulnerabilities) - Removed TypeScript jest types configuration - Updated build configuration to work without test dependencies - Preserved the Jest 30.x compatibility work in the codebase for future restoration - Build and TypeScript compilation now working without vulnerable dependencies #### ⚠️ REMAINING VULNERABILITIES - `debug` package still present through `@modelcontextprotocol/sdk` dependency chain - 9 critical vulnerabilities remaining (down from 85) ### Mitigation Strategy #### Phase 1: Immediate Risk Reduction ✅ - Removed 76 of 85 critical vulnerabilities by eliminating Jest dependencies - System can now build and run core functionality without most malware packages #### Phase 2: Automated Security Monitoring ✅ - **Dependabot configured** for automated security monitoring and updates - Daily checks for npm package security updates - Automatic PR creation when clean versions of `@modelcontextprotocol/sdk` are available - Comprehensive dependency security management implemented #### Phase 3: Complete Remediation (IN PROGRESS) - Monitor for clean versions of `debug` package (automated via Dependabot) - Consider alternative MCP SDK versions when available (automated detection) - Dependency scanning active in CI/CD #### Phase 4: Test Restoration (TODO) - Wait for security all-clear from npm security team - Restore Jest 30.x dependencies with known-clean versions (Dependabot will auto-propose) - Re-enable full test suite ### Environment Verification To verify malware removal: ```bash # Check for suspicious code patterns find . -name "*.js" -exec grep -l "eval.*atob\|btoa" {} \; 2>/dev/null || echo "No suspicious code found" # Check current vulnerabilities npm audit --audit-level=critical # Verify package versions npm list debug ``` ### Recovery Plan 1. **Current State**: Core functionality preserved, build working, 90% of vulnerabilities eliminated 2. **Automated Monitoring**: Dependabot now monitoring for clean versions of remaining vulnerable packages 3. **Test Restoration**: Dependabot will automatically propose Jest 30.x restoration once environment is clean ### Dependabot Configuration **Automatic Security Monitoring**: - Daily checks for security updates to `@modelcontextprotocol/sdk` and all dependencies - Immediate PR creation when clean versions become available - Comprehensive dependency security management - See `docs/DEPENDABOT.md` for full configuration details **Expected Resolution**: Dependabot will automatically detect and propose updates when: - Clean versions of `@modelcontextprotocol/sdk` without vulnerable `debug` dependency are released - Security patches for any remaining vulnerabilities become available - Jest testing dependencies can be safely restored ### Jest 30.x Compatibility Preservation The Jest 30.x compatibility fixes have been preserved: - `jest.config.js` - Contains the `workerThreads: false` fix - `tests/smoke.test.ts` - Updated with ES module imports - All compatibility work is ready for restoration when clean packages are available ### Contact - Report security concerns immediately - Monitor npm security advisories - Coordinate with MCP SDK maintainers for clean dependency versions