Loading npm security reports…

@browserless.io/mcp@1.11.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @browserless.io/mcp / 1.11.0

@browserless.io/mcp@1.11.0

MCP (Model Context Protocol) server for the Browserless.io browser automation platform

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 35 file(s), 240 KB of source, external domains: 127.0.0.1, api.beta.devin.ai, api.devin.ai, api.itsdev.in, chatgpt.com, claude.ai, developer.chrome.com, docs.browserless.io, eu1.make.celonis.com, ex.com, example.com, mcp.browserless.io, production-sfo.browserless.io, us1.make.celonis.com, www.make.com

Source & flagged code

5 flagged

build/src/skills/sites/vaccines.gov/find-appointment-55bu87/SKILL.mdView file

Lines 58-98markdown

58The optimal path is **hybrid**: call the same Google Places `searchText` endpoint that vaccines.gov calls (one HTTP POST, no auth beyond a publicly-embedded API key, ~0.5s), filter results to the requested chains, then construct per-chain scheduler URLs. The browser path is a fallback when the API key has been rotated or rate-limited; it pays ~50× the cost and still returns the same data (vaccines.gov's frontend is a thin React wrapper over the exact API call below).

60### 1. Geocode the ZIP → lat/lng bounding box

62Vaccines.gov uses a `getBoundsOfDistance({latitude, longitude}, radiusMeters)` helper to convert a ZIP centroid + radius into a `{low, high}` rectangle. Any geocoding source works; the simplest is the Google Geocoding API or a static USPS ZCTA centroid table. Default radius in the vaccines.gov UI is **8047 meters (~5 miles)**; raise to **16093 m (~10 mi)** or **40234 m (~25 mi)** for sparse rural ZIPs.

64Example for ZIP 10001 (NYC, centroid 40.7506 / -74.0014, 5-mile radius):

66```json

67{

68 "low": { "latitude": 40.6783, "longitude": -74.0966 },

69 "high": { "latitude": 40.8228, "longitude": -73.9062 }

70}

71```

73### 2. Call Google Places `searchText`

75```

76POST https://places.googleapis.com/v1/places:searchText

77 Content-Type: application/json

78 X-Goog-Api-Key: AIzaSyCVvG6ZXIlxy76PCbqGnf9cP37XtA3HE-M

High

High Secret

Package contains a high-severity secret pattern.

build/src/skills/sites/vaccines.gov/find-appointment-55bu87/SKILL.mdView on unpkg · L78

High

Secret Pattern

Google API key in build/src/skills/sites/vaccines.gov/find-appointment-55bu87/SKILL.md

build/src/skills/sites/vaccines.gov/find-appointment-55bu87/SKILL.mdView on unpkg · L78

79 X-Goog-FieldMask: places.id,places.displayName.text,places.nationalPhoneNumber,

80 places.formattedAddress,places.addressComponents,places.location,

81 places.websiteUri,places.rating,places.primaryType,

82 places.regularOpeningHours.openNow,nextPageToken

84{

85 "textQuery": "pharmacy zip code 10001",

86 "languageCode": "en",

87 "includedType": "pharmacy",

88 "rankPreference": "RELEVANCE",

89 "strictTypeFiltering": true,

90 "regionCode": "US",

91 "pageSize": 20,

92 "locationRestriction": { "rectangle": { "low": {...}, "high": {...} } }

93}

94```

96The key, request shape, and field mask are exactly what vaccines.gov ships in `/_next/static/chunks/app/[locale]/results/page-*.js` (verified 2026-05-18). Paginate with `pageToken` from `nextPageToken` — vaccines.gov caps at **3 pages × 20 results = 50 max**. Iterate `pageSize=20` × up to `c<3` page tokens, accumulating until `o.length >= 50` (the literal cap from the bundle).

98**Transport note (Browserless):** This is a **cross-origin** call to

Lines 133-173markdown

133`browserless_agent` call carrying `proxy: { proxy: "residential" }` (the site sits behind

134Akamai — `akamai_visit_id` cookie is set on first response, and bare sessions get

135challenged). Keep all steps in **one** call's `commands` array so cookies/session persist:

136

1371. `{ "method": "goto", "params": { "url": "https://www.vaccines.gov/en/", "waitUntil": "load", "timeout": 45000 } }`

1382. `{ "method": "type", "params": { "selector": "<zip input>", "text": "10001" } }`, then `{ "method": "click", "params": { "selector": "<search button>" } }`

build/src/skills/sites/youtube.com/extract-transcript-loeude/SKILL.mdView file

Lines 247-287markdown

247 { "method": "waitForTimeout", "params": { "time": 3000 } }, // let the player chrome render

248 {

249 "method": "evaluate",

250 "params": {

251 "content": "(async () => { const pr = window.ytInitialPlayerResponse || null; if (!pr) return JSON.stringify({ error: 'no_player_response' }); const tracks = pr?.captions?.playerCaptionsTracklistRenderer?.captionTracks || []; let events = null; if (tracks.length) { const url = tracks[0].baseUrl + '&fmt=json3'; try { const j = await fetch(url).then(r => r.json()); events = j.events || null; } catch (e) { events = null; } } return JSON.stringify({ playabilityStatus: pr.playabilityStatus, videoDetails: pr.videoDetails, tracks: tracks.map(t => ({ baseUrl: t.baseUrl, languageCode: t.languag ...

252 },

253 },

254

build/src/skills/sites/rec.us/sf-court-booking-c8l5z9/SKILL.mdView file

Lines 198-238markdown

198 "end_time_local": "13:30",

199 "duration_minutes": 90,

200 "price_cents": 750,

201 "currency": "USD"

202}

203```

204

205If during skill execution you cannot find a confirmation code on the post-book page, fall back to navigating to `https://www.rec.us/account/reservations` and reading the most-recently-created entry; its `id` UUID prefix is the canonical confirmation code.

206

207### 7. Session teardown

Source & flagged code

5 flagged · loading source

build/src/skills/sites/vaccines.gov/find-appointment-55bu87/SKILL.md

Source & flagged code

5 flagged

build/src/skills/sites/vaccines.gov/find-appointment-55bu87/SKILL.mdView file

Lines 58-98markdown

60### 1. Geocode the ZIP → lat/lng bounding box

64Example for ZIP 10001 (NYC, centroid 40.7506 / -74.0014, 5-mile radius):

66```json

67{

68 "low": { "latitude": 40.6783, "longitude": -74.0966 },

69 "high": { "latitude": 40.8228, "longitude": -73.9062 }

70}

71```

73### 2. Call Google Places `searchText`

75```

76POST https://places.googleapis.com/v1/places:searchText

77 Content-Type: application/json

78 X-Goog-Api-Key: AIzaSyCVvG6ZXIlxy76PCbqGnf9cP37XtA3HE-M

High

High Secret

Package contains a high-severity secret pattern.

build/src/skills/sites/vaccines.gov/find-appointment-55bu87/SKILL.mdView on unpkg · L78

High

Secret Pattern

Google API key in build/src/skills/sites/vaccines.gov/find-appointment-55bu87/SKILL.md

build/src/skills/sites/vaccines.gov/find-appointment-55bu87/SKILL.mdView on unpkg · L78

79 X-Goog-FieldMask: places.id,places.displayName.text,places.nationalPhoneNumber,

80 places.formattedAddress,places.addressComponents,places.location,

81 places.websiteUri,places.rating,places.primaryType,

82 places.regularOpeningHours.openNow,nextPageToken

84{

85 "textQuery": "pharmacy zip code 10001",

86 "languageCode": "en",

87 "includedType": "pharmacy",

88 "rankPreference": "RELEVANCE",

89 "strictTypeFiltering": true,

90 "regionCode": "US",

91 "pageSize": 20,

92 "locationRestriction": { "rectangle": { "low": {...}, "high": {...} } }

93}

94```

98**Transport note (Browserless):** This is a **cross-origin** call to

Lines 133-173markdown

133`browserless_agent` call carrying `proxy: { proxy: "residential" }` (the site sits behind

134Akamai — `akamai_visit_id` cookie is set on first response, and bare sessions get

135challenged). Keep all steps in **one** call's `commands` array so cookies/session persist:

136

1371. `{ "method": "goto", "params": { "url": "https://www.vaccines.gov/en/", "waitUntil": "load", "timeout": 45000 } }`

1382. `{ "method": "type", "params": { "selector": "<zip input>", "text": "10001" } }`, then `{ "method": "click", "params": { "selector": "<search button>" } }`

build/src/skills/sites/youtube.com/extract-transcript-loeude/SKILL.mdView file

Lines 247-287markdown

247 { "method": "waitForTimeout", "params": { "time": 3000 } }, // let the player chrome render

248 {

249 "method": "evaluate",

250 "params": {

252 },

253 },

254

build/src/skills/sites/rec.us/sf-court-booking-c8l5z9/SKILL.mdView file

Lines 198-238markdown

198 "end_time_local": "13:30",

199 "duration_minutes": 90,

200 "price_cents": 750,

201 "currency": "USD"

202}

203```

204

206

207### 7. Session teardown

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code