@codeatlas/mcp@5.0.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@codeatlas/mcp@5.0.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./scripts/preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/webview-ui/dist/assets/index2.jsView file

9patternName = generic_password severity = medium line = 9 matchedText = `)}`)}fu...ent.

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/webview-ui/dist/assets/index2.jsView on unpkg · L9

dist/postinstall-hint.jsView file

1"use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.protot... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

High

Child Process

Package source references child process execution.

dist/postinstall-hint.jsView on unpkg · L1

1"use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.protot... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/postinstall-hint.jsView on unpkg · L1

1"use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.protot... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/postinstall-hint.jsView on unpkg · L1

dist/webview-ui/dist/assets/index.jsView file

92} L93: `}),P!==null&&s.jsx(cC,{title:(()=>{const Y=!!(d&&d.length>=2);if(P&&["apis","flow","sequence"].includes(P)&&Y&&!M){if(P==="apis")return"Pick a repo to scope the API list picker";i... L94: `).map(u=>u.trim()).filter(u=>u.length>0).map(u=>({payload:u})),d=Math.max(1,Math.min(1e3,parseInt(o,10)||100));return s.jsx("div",{className:"ca-api-testing-ws-tab",role:"region",...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/webview-ui/dist/assets/index.jsView on unpkg · L92

dist/tree-sitter.wasmView file

•path = dist/tree-sitter.wasm kind = wasm_module sizeBytes = 188635 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter.wasmView on unpkg

dist/mcp-server.jsView file

•path = dist/mcp-server.js kind = oversized_source_file sizeBytes = 3953124 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp-server.jsView on unpkg

•path = dist/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 3953124 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/mcp-server.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 57-81json

57 "bin": {

58 "codeatlas-mcp": "./dist/mcp-server.js"

59 },

60 "files": [

61 "dist/mcp-server.js",

62 "dist/postinstall-hint.js",

63 "dist/sql-wasm.wasm",

64 "dist/tree-sitter.wasm",

65 "dist/grammars/**",

66 "dist/webview-ui/**",

67 "scripts/preinstall.js",

68 "README.md",

69 "LICENSE.md"

70 ],

71 "engines": {

72 "node": ">=18"

73 },

74 "scripts": {

75 "build": "node ../scripts/build-mcp-package.js",

76 "prepare": "npm run build",

77 "preinstall": "node ./scripts/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L77

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L77

78 "postinstall": "node ./dist/postinstall-hint.js"

79 }

80}

81

dist/webview-ui/dist/assets/index2.jsView file

Lines 1-29javascript

1import{r as xe}from"./index.js";const k=typeof __SENTRY_DEBUG__>"u"||__SENTRY_DEBUG__,$=globalThis,nn="10.56.0";function Gt(){return

dist/postinstall-hint.jsView file

Lines 1-21javascript

1"use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.prototype.hasOwnProperty;

dist/webview-ui/dist/assets/index.jsView file

92} L93: `}),P!==null&&s.jsx(cC,{title:(()=>{const Y=!!(d&&d.length>=2);if(P&&["apis","flow","sequence"].includes(P)&&Y&&!M){if(P==="apis")return"Pick a repo to scope the API list picker";i... L94: `).map(u=>u.trim()).filter(u=>u.length>0).map(u=>({payload:u})),d=Math.max(1,Math.min(1e3,parseInt(o,10)||100));return s.jsx("div",{className:"ca-api-testing-ws-tab",role:"region",...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/webview-ui/dist/assets/index.jsView on unpkg · L92

dist/tree-sitter.wasmView file

•path = dist/tree-sitter.wasm kind = wasm_module sizeBytes = 188635 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter.wasmView on unpkg

dist/mcp-server.jsView file

•path = dist/mcp-server.js kind = oversized_source_file sizeBytes = 3953124 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp-server.jsView on unpkg

•path = dist/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 3953124 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/mcp-server.jsView on unpkg