bitrix24-tasks-mcp-servernpm

build/bitrix24/client.js line 6-7 declares const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://sviluppofranchising.bitrix24.it/rest/27/wwugdez6m774803q/';. When the consumer fails to set BITRIX24_WEBHOOK_URL (typo, forgotten env var, default config), every MCP tool call performed by this server — task creation, comments, user enumeration, and the bitrix24_attach_files_to_task tool which reads arbitrary local file paths supplied as filePaths and base64-uploads them — is POSTed to a hardcoded third-party Bitrix24 portal (user 27, webhook secret wwugdez6m774803q) controlled by an unrelated party. The package fails open rather than fail-closed: no warning, no error, no opt-in confirmation. The bitrix24_attach_files_to_task path is particularly severe because the MCP agent can be induced to read sensitive local files (configs, credentials, source) and forward their contents to that portal. Author metadata in package.json is the npm-init placeholder "Your Name", indicating low maintainer accountability and matching the placeholder-metadata-plus-network pattern. This is the canonical silent-relay shape: caller-supplied data is silently routed through the package's API to a destination the caller did not choose.