@cosmocoder/mcp-web-docs@2.0.22: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@cosmocoder/mcp-web-docs@2.0.22: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = npx playwright install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npx playwright install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

build/crawler/crawlee-crawler.jsView file

224return context.evaluate(async (code) => { L225: const ExtractorClass = new Function(`return ${code}`)(); L226: const extractor = new ExtractorClass();

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/crawler/crawlee-crawler.jsView on unpkg · L224

build/util/security.jsView file

4*/ L5: import { createCipheriv, createDecipheriv, randomBytes, scryptSync, createHash } from 'node:crypto'; L6: import { z } from 'zod'; ... L21: // In production, consider using a proper secret management system L22: const machineId = process.env.MCP_WEB_DOCS_SECRET || `${process.env.HOME || ''}:${process.platform}:mcp-web-docs`; L23: return scryptSync(machineId, salt, KEY_LENGTH); ... L81: * Validate and sanitize a URL for safe usage L82: * Prevents SSRF attacks by blocking private/internal networks L83: * @param urlString - URL to validate ... L144: * Check if a regex pattern is safe (not vulnerable to ReDoS) L145: * Uses safe-regex2 from https://github.com/fastify/safe-regex2 L146: * @param pattern - Regex pattern string to check

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

build/util/security.jsView on unpkg · L4

build/crawler/llms-txt.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cosmocoder/mcp-web-docs@2.0.20 matchedIdentity = npm:[redacted]:2.0.20 similarity = 0.621 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/crawler/llms-txt.jsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 35-75json

35 "files": [

36 "build",

37 "README.md",

38 "LICENSE",

39 "CHANGELOG.md"

40 ],

41 "scripts": {

42 "build": "tsc && chmod +x build/index.js",

43 "start": "node build/index.js",

44 "dev": "tsc -w",

45 "lint": "eslint . --ext .js,.ts",

46 "lint:fix": "npm run lint -- --fix",

47 "test": "vitest run",

48 "test:watch": "vitest",

49 "test:ui": "vitest --ui",

50 "test:coverage": "vitest run --coverage",

51 "test:types": "tsc --noEmit",

52 "prettier": "prettier --write .",

53 "prettier:ci": "prettier --check .",

54 "clean": "rm -rf build",

55 "postinstall": "npx playwright install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "prepare": "husky",

57 "create-release": "semantic-release"

58 },

59 "dependencies": {

60 "@andersmyrmel/vard": "1.2.0",

61 "@lancedb/lancedb": "0.31.0",

62 "@modelcontextprotocol/sdk": "1.29.0",

63 "cheerio": "1.2.0",

64 "cli-progress": "3.12.0",

65 "crawlee": "3.17.0",

66 "default-browser": "5.5.0",

67 "fastembed": "2.1.0",

68 "node-html-markdown": "2.0.0",

69 "pdfjs-dist": "5.7.284",

70 "playwright": "1.61.1",

71 "proxy-chain": "2.7.1",

72 "quick-lru": "7.3.0",

73 "safe-regex2": "5.1.1",

74 "semver": "7.8.5",

75 "sqlite": "5.1.1",

build/crawler/crawlee-crawler.jsView file

Lines 204-244javascript

204 .waitForLoadState('networkidle', { timeout: 5000 })

205 .catch(() => logger.debug('Frame network idle timeout - continuing anyway')),

206 ]);

207 return frame;

208

build/util/security.jsView file

Lines 1-24javascript

1/**

2 * Security utilities for mcp-web-docs

3 * Handles encryption, input sanitization, and validation

4 */

5import { createCipheriv, createDecipheriv, randomBytes, scryptSync, createHash } from 'node:crypto';

6import { z } from 'zod';

7import safeRegex

build/crawler/llms-txt.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cosmocoder/mcp-web-docs@2.0.20 matchedIdentity = npm:[redacted]:2.0.20 similarity = 0.621 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/crawler/llms-txt.jsView on unpkg