@api-now/mcp@1.8.0: Suspicious npm security report (Warn)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.33 MB of source, external domains: a.ml, api.apinow.app, www.w3.org

Source & flagged code

1 flagged

dist/bin/mcp.jsView file

1#!/usr/bin/env node L2: var Dl=Object.create;var Es=Object.defineProperty;var Ul=Object.getOwnPropertyDescriptor;var zl=Object.getOwnPropertyNames;var Ll=Object.getPrototypeOf,Fl=Object.prototype.hasOwnPr... L3: `)}*keys(){let e=Object.keys(this._map);for(let t of e)this._map[t].enabled&&(yield this._map[t].name)}*values(){let e=Object.keys(this._map);for(let t of e)this._map[t].enabled&&(... L4: ... L16: `)}function qs(a,e){if(typeof a=="number")return a;let t=Number(a);return Number.isNaN(t)?e:t}function Js(a,e){let t=typeof a;if(t==="boolean")return a;if(t==="string"){let i=a.tri... L17: `):`${ei({[t]:r})}`:`${ei(r,s)}`}};var Ne={};un(Ne,{anyShape:()=>xt,arrayShape:()=>ed,fileShape:()=>Qc,nodeShape:()=>Xc,propertyShape:()=>id,recursiveShape:()=>rd,scalarShape:()=>Y... L18: `:" ")}paragraphs(e={}){let t={};typeof e=="number"?t.size=e:t={...e};let{separator:i=`\r ... L50: - Publishing a verified data domain version to make it available for APIs or other domains to import.`,inputSchema:ve.object({fileId:ve.string().describe("The database file ID repr... L51: ${JSON.stringify(o,null,2)}`}],structuredContent:o}}catch(t){return ee(t,"Error publishing to catalog")}})}var Oe=new xm

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/mcp.jsView on unpkg · L1

Source & flagged code

1 flagged · loading source

dist/bin/mcp.jsView file

1#!/usr/bin/env node L2: var Dl=Object.create;var Es=Object.defineProperty;var Ul=Object.getOwnPropertyDescriptor;var zl=Object.getOwnPropertyNames;var Ll=Object.getPrototypeOf,Fl=Object.prototype.hasOwnPr... L3: `)}*keys(){let e=Object.keys(this._map);for(let t of e)this._map[t].enabled&&(yield this._map[t].name)}*values(){let e=Object.keys(this._map);for(let t of e)this._map[t].enabled&&(... L4: ... L16: `)}function qs(a,e){if(typeof a=="number")return a;let t=Number(a);return Number.isNaN(t)?e:t}function Js(a,e){let t=typeof a;if(t==="boolean")return a;if(t==="string"){let i=a.tri... L17: `):`${ei({[t]:r})}`:`${ei(r,s)}`}};var Ne={};un(Ne,{anyShape:()=>xt,arrayShape:()=>ed,fileShape:()=>Qc,nodeShape:()=>Xc,propertyShape:()=>id,recursiveShape:()=>rd,scalarShape:()=>Y... L18: `:" ")}paragraphs(e={}){let t={};typeof e=="number"?t.size=e:t={...e};let{separator:i=`\r ... L50: - Publishing a verified data domain version to make it available for APIs or other domains to import.`,inputSchema:ve.object({fileId:ve.string().describe("The database file ID repr... L51: ${JSON.stringify(o,null,2)}`}],structuredContent:o}}catch(t){return ee(t,"Error publishing to catalog")}})}var Oe=new xm

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/mcp.jsView on unpkg · L1

Findings

1 High3 Medium8 Low

HighSandbox Evasion Gated Capabilitydist/bin/mcp.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License