@beepflow/mcp@2026.7.0: Suspicious npm security report (Warn)

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 1 file(s), 912 KB of source, external domains: auth.beepflow.com, beepflow.com, file.fewlogs.com, json-schema.org

Source & flagged code

4 flagged

dist/index.jsView file

13`)}return{server:o,closeServer:a}}import{createHash as f4}from"node:crypto";import uh from"node:os";import ps from"node:path";var sR={dev:{name:"dev",frontendUrl:"http://localhost:... L14: `,"utf8")}async function dh(e){let t=Ht(),n=await fetch(`${t.authUrl}/email/request-code`,{method:"POST",headers:{"content-type":"application/json",domain:t.authDomain},body:JSON.s... L15: values (?, ?, ?, ?, ?)

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

7`,OPEN_CURLY_BRACKET:"{",OPEN_ROUND_BRACKET:"(",OPEN_SQUARE_BRACKET:"[",SEMICOLON:";",SINGLE_QUOTE:"'",SPACE:" ",TAB:" ",UNDERSCORE:"_"};U0.exports=TD});var Su=z((Kq,V0)=>{function... L8: `)==-1||n.indexOf("expression")===0||n.indexOf(yg.SINGLE_QUOTE)>-1||n.indexOf(yg.DOUBLE_QUOTE)>-1?n:(n=n.replace(qk,""),n=n.replace(zk," "),n.indexOf("calc")>-1&&(n=n.replace(Uk,")... L9: `);e.line+=n.length-1,e.column=n.length>1?0:e.column+n.pop().length}function GM(e,t){var n={column:0,format:t.options.format,indentBy:0,indentWith:"",line:1,output:[],spaceAfterClo... ... L13: `)}return{server:o,closeServer:a}}import{createHash as f4}from"node:crypto";import uh from"node:os";import ps from"node:path";var sR={dev:{name:"dev",frontendUrl:"http://localhost:... L14: `,"utf8")}async function dh(e){let t=Ht(),n=await fetch(`${t.authUrl}/email/request-code`,{method:"POST",headers:{"content-type":"application/json",domain:t.authDomain},body:JSON.s... L15: values (?, ?, ?, ?, ?)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L7

6`,System:uD()},_d={Space:" ",Tab:" "},ol={AroundSelectorRelation:"aroundSelectorRelation",BeforeBlockBegins:"beforeBlockBegins",BeforeValue:"beforeValue"},bu={breaks:N0(!1),breakWi... L7: `,OPEN_CURLY_BRACKET:"{",OPEN_ROUND_BRACKET:"(",OPEN_SQUARE_BRACKET:"[",SEMICOLON:";",SINGLE_QUOTE:"'",SPACE:" ",TAB:" ",UNDERSCORE:"_"};U0.exports=TD});var Su=z((Kq,V0)=>{function... L8: `)==-1||n.indexOf("expression")===0||n.indexOf(yg.SINGLE_QUOTE)>-1||n.indexOf(yg.DOUBLE_QUOTE)>-1?n:(n=n.replace(qk,""),n=n.replace(zk," "),n.indexOf("calc")>-1&&(n=n.replace(Uk,")... L9: `);e.line+=n.length-1,e.column=n.length>1?0:e.column+n.pop().length}function GM(e,t){var n={column:0,format:t.options.format,indentBy:0,indentWith:"",line:1,output:[],spaceAfterClo... L10: `);n&&eL(e,n),e.line+=r.length-1,e.column=r.length>1?0:e.column+r.pop().length}function eL(e,t){for(var n=0,r=t.length;n<r;n++)tL(e,t[n])}function tL(e,t){var n=t[0],r=t[1],i=t[2],... L11: `)}catch{}}}function s(p){for(i+=p;;){let m=i.indexOf(` ... L13: `)}return{server:o,closeServer:a}}import{createHash as f4}from"node:crypto";import uh from"node:os";import ps from"node:path";var sR={dev:{name:"dev",frontendUrl:"http://localhost:... L14:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L6

6`,System:uD()},_d={Space:" ",Tab:" "},ol={AroundSelectorRelation:"aroundSelectorRelation",BeforeBlockBegins:"beforeBlockBegins",BeforeValue:"beforeValue"},bu={breaks:N0(!1),breakWi... L7: `,OPEN_CURLY_BRACKET:"{",OPEN_ROUND_BRACKET:"(",OPEN_SQUARE_BRACKET:"[",SEMICOLON:";",SINGLE_QUOTE:"'",SPACE:" ",TAB:" ",UNDERSCORE:"_"};U0.exports=TD});var Su=z((Kq,V0)=>{function... L8: `)==-1||n.indexOf("expression")===0||n.indexOf(yg.SINGLE_QUOTE)>-1||n.indexOf(yg.DOUBLE_QUOTE)>-1?n:(n=n.replace(qk,""),n=n.replace(zk," "),n.indexOf("calc")>-1&&(n=n.replace(Uk,")... L9: `);e.line+=n.length-1,e.column=n.length>1?0:e.column+n.pop().length}function GM(e,t){var n={column:0,format:t.options.format,indentBy:0,indentWith:"",line:1,output:[],spaceAfterClo... L10: `);n&&eL(e,n),e.line+=r.length-1,e.column=r.length>1?0:e.column+r.pop().length}function eL(e,t){for(var n=0,r=t.length;n<r;n++)tL(e,t[n])}function tL(e,t){var n=t[0],r=t[1],i=t[2],... L11: `)}catch{}}}function s(p){for(i+=p;;){let m=i.indexOf(` ... L13: `)}return{server:o,closeServer:a}}import{createHash as f4}from"node:crypto";import uh from"node:os";import ps from"node:path";var sR={dev:{name:"dev",frontendUrl:"http://localhost:... L14:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L6

Source & flagged code

4 flagged · loading source

dist/index.jsView file

13`)}return{server:o,closeServer:a}}import{createHash as f4}from"node:crypto";import uh from"node:os";import ps from"node:path";var sR={dev:{name:"dev",frontendUrl:"http://localhost:... L14: `,"utf8")}async function dh(e){let t=Ht(),n=await fetch(`${t.authUrl}/email/request-code`,{method:"POST",headers:{"content-type":"application/json",domain:t.authDomain},body:JSON.s... L15: values (?, ?, ?, ?, ?)

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

7`,OPEN_CURLY_BRACKET:"{",OPEN_ROUND_BRACKET:"(",OPEN_SQUARE_BRACKET:"[",SEMICOLON:";",SINGLE_QUOTE:"'",SPACE:" ",TAB:" ",UNDERSCORE:"_"};U0.exports=TD});var Su=z((Kq,V0)=>{function... L8: `)==-1||n.indexOf("expression")===0||n.indexOf(yg.SINGLE_QUOTE)>-1||n.indexOf(yg.DOUBLE_QUOTE)>-1?n:(n=n.replace(qk,""),n=n.replace(zk," "),n.indexOf("calc")>-1&&(n=n.replace(Uk,")... L9: `);e.line+=n.length-1,e.column=n.length>1?0:e.column+n.pop().length}function GM(e,t){var n={column:0,format:t.options.format,indentBy:0,indentWith:"",line:1,output:[],spaceAfterClo... ... L13: `)}return{server:o,closeServer:a}}import{createHash as f4}from"node:crypto";import uh from"node:os";import ps from"node:path";var sR={dev:{name:"dev",frontendUrl:"http://localhost:... L14: `,"utf8")}async function dh(e){let t=Ht(),n=await fetch(`${t.authUrl}/email/request-code`,{method:"POST",headers:{"content-type":"application/json",domain:t.authDomain},body:JSON.s... L15: values (?, ?, ?, ?, ?)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.js

Findings

3 High4 Medium7 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License