@debugbundle/mcp: Suspicious npm security report (Warn)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 2 file(s), 1.20 MB of source, external domains: api.debugbundle.com, debugbundle.com, github.com, json-schema.org

Source & flagged code

2 flagged

dist/main.cjsView file

21740patternName = generic_password severity = medium line = 21740 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/main.cjsView on unpkg · L21740

bin/debugbundle-mcp.jsView file

Lines 1-12javascript

1#!/usr/bin/env node

2import { createRequire } from "node:module";

3import { dirname, resolve } from "node:path";

4import { fileURLToPath } from "node:url";

5

6const require = createRequire(import.meta.url);

7const binDirectory = dirname(fileURLToPath(import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/debugbundle-mcp.jsView on unpkg · L5

8const packageRoot = resolve(binDirectory, "..");

9const mainPath = resolve(packageRoot, "dist/main.cjs");

10

11require(mainPath);

12

Source & flagged code

2 flagged · loading source

dist/main.cjsView file

21740

@debugbundle/mcp@1.7.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code