@azure/mcp-linux-x64

AI Security Review

Evidence context: threat category none; evidence quality moderate.

@azure/mcp-linux-x64 carries the Linux x64 payload of Microsoft's Azure MCP Server, published under the microsoft1es developer name at version 3.0.0-beta.48. The package declares no permissions and no host permissions, produces no network findings, and its 11,234 entries come almost entirely from static extraction run across bundled files.

Tool poisoning. The tool-poisoning category holds zero findings. Nothing in this package contains directives aimed at an AI agent, nothing tells an assistant to hide behaviour from the user, and nothing asks for a command to run before a reply. That fits what this artifact is: a per-platform binary distribution. Tool definitions and descriptions for Azure live in the main server package, which this one supplies a runtime for.

Credentials and network. Zero secret findings and zero credential-access findings. Nothing here reads .ssh, .aws/credentials, .kube/config or application_default_credentials.json, so there is no harvest step. There is also no send step, because the network category is empty. The endpoint list is extraction noise rather than destinations: entries such as 5-verify.md and 6-generate-iac.md are markdown filenames from the repository docs, 6libmicrosoft.cognitiveservices.speech.extension.kws.so is a shared-object filename, and 0asp.net, 2qv.tk and 1n.gr are fragments of longer strings inside compiled libraries. The one hostname that maps to a shipped Microsoft product, microsoft.identity.client.platforms.net, belongs to Microsoft's identity client libraries. Exfiltration needs a credential read next to a call to an unknown host, and neither side of that pair exists here.

The IoC set is 11,025 medium-severity SHA256 hashes plus that single domain, every one of them tagged extracted_from_files. A hash finding means the scanner hashed a file it unpacked. It becomes a problem only when the file behind it matches a known sample, and the malware-signature category reports zero matches across the entire package. The remaining 209 low-severity entries are code-smell rules that fire on any large JavaScript or native bundle.

Strongest counterargument. Platform-specific native packages skip the source review that a plain npm package invites, and 3.0.0-beta.48 is a prerelease on a fast version cadence, which is exactly the shape a rug-pull would take. That argument would matter if any signal pointed at behaviour. Tool poisoning, network activity, credential access and malware signatures all read zero, and a malicious later build would move at least one of those. Microsoft's 1ES group publishing @azure/mcp-linux-x64 under the @azure scope also rules out typosquatting and name squatting.

Key Reasons

• Zero tool-poisoning findings, which fits a platform-specific binary with no tool descriptions of its own
• Zero secret and zero credential-access findings: nothing references .ssh, .aws/credentials or .kube/config
• Zero network findings and zero malware-signature matches, so no harvest-and-send architecture exists here
• The endpoint list is extraction noise: 5-verify.md and 6-generate-iac.md are doc filenames, 6libmicrosoft.cognitiveservices.speech.extension.kws.so is a shared-object name
• Published under the microsoft1es developer name inside the @azure scope at version 3.0.0-beta.48, with no name-squatting signal

False Positive Considerations

• XIOC hashing of every bundled native binary and shared library under extracted_from_files
• Domain-shaped fragments parsed out of compiled library strings, markdown filenames and .so names
• YARA code-smell rules firing on bundled JavaScript in a large dist payload
• No manifest, network, credential or tool-poisoning findings to corroborate any of it

Reviewed 2026-10-01; recommended action: no action; model confidence 84%.