@digitalygo/diggocms-sdk-core@0.9.0: Suspicious npm security | LPM Firewall

Loading npm security reports…

@digitalygo/diggocms-sdk-core@0.9.0: Suspicious npm security | LPM Firewall

mcp-bundle/dist/cli.jsView file

225L226: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let t of n.seen.entries()){let g=t[1];if(i===t[0]){v(t);continue}if(n.external){let D=n.exter... L227: `:""},this._extScope=n,this._scope=new li.Scope({parent:n}),this._nodes=[new YX]}toString(){return this._root.render(this.opts)}name(n){return this._scope.name(n)}scopeName(n){retu... ... L240: --${F}--\r L241: `,H=Buffer.from(X,"utf-8"),R=Buffer.concat([H,A,Buffer.from(V,"utf-8")]),B=await n.request(r,{method:"POST",headers:{"Content-Type":`multipart/form-data; boundary=${F}`},body:R},5)... L242: `),r.pass)i++}if(process.stderr.write(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

mcp-bundle/dist/cli.jsView on unpkg · L225

149`)}try{await zG(z,A,384),process.stderr.write(`Wrote .env.mcp-diggo. L150: `)}catch(J){let F=J instanceof Error?J.message:String(J);if(nu(L))process.stderr.write(`Env write failed: ${F}. Previous env preserved at ${L}. L151: `);throw Error(`Failed to write .env.mcp-diggo: ${F}`)}try{let J=await mA(i,$.mcpVersion,$.bundleDigest,r,u);process.stderr.write(`Registered mcp-diggo in ${J.path}. ... L161: `),!g.DESTRUCTIVE_TOOLS_ENABLED)process.stderr.write(`Destructive tools disabled. The MCP server will have a reduced-risk write inventory: mutation and provisioning tools that pass... L162: `);process.stderr.write("\nRun `mcp-diggo doctor` to verify the installation.\n")}var x5;var WG=S(()=>{xv();G4();j4();av();On();x5=["opencode.json","opencode.jsonc"]});function O(n... L163: `)}var EG=(n,

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

mcp-bundle/dist/cli.jsView on unpkg · L149

161`),!g.DESTRUCTIVE_TOOLS_ENABLED)process.stderr.write(`Destructive tools disabled. The MCP server will have a reduced-risk write inventory: mutation and provisioning tools that pass... L162: `);process.stderr.write("\nRun `mcp-diggo doctor` to verify the installation.\n")}var x5;var WG=S(()=>{xv();G4();j4();av();On();x5=["opencode.json","opencode.jsonc"]});function O(n... L163: `)}var EG=(n,i)=>{n.name="$ZodError",Object.defineProperty(n,"_zod",{value:n._zod,enumerable:!1}),Object.defineProperty(n,"issues",{value:i,enumerable:!1}),n.message=JSON.stringify...

Low

Eval

Package source references a known benign dynamic code generation pattern.

mcp-bundle/dist/cli.jsView on unpkg · L161

mcp-bundle/dist/cli.jsView file

225L226: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let t of n.seen.entries()){let g=t[1];if(i===t[0]){v(t);continue}if(n.external){let D=n.exter... L227: `:""},this._extScope=n,this._scope=new li.Scope({parent:n}),this._nodes=[new YX]}toString(){return this._root.render(this.opts)}name(n){return this._scope.name(n)}scopeName(n){retu... ... L240: --${F}--\r L241: `,H=Buffer.from(X,"utf-8"),R=Buffer.concat([H,A,Buffer.from(V,"utf-8")]),B=await n.request(r,{method:"POST",headers:{"Content-Type":`multipart/form-data; boundary=${F}`},body:R},5)... L242: `),r.pass)i++}if(process.stderr.write(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

mcp-bundle/dist/cli.jsView on unpkg · L225

149`)}try{await zG(z,A,384),process.stderr.write(`Wrote .env.mcp-diggo. L150: `)}catch(J){let F=J instanceof Error?J.message:String(J);if(nu(L))process.stderr.write(`Env write failed: ${F}. Previous env preserved at ${L}. L151: `);throw Error(`Failed to write .env.mcp-diggo: ${F}`)}try{let J=await mA(i,$.mcpVersion,$.bundleDigest,r,u);process.stderr.write(`Registered mcp-diggo in ${J.path}. ... L161: `),!g.DESTRUCTIVE_TOOLS_ENABLED)process.stderr.write(`Destructive tools disabled. The MCP server will have a reduced-risk write inventory: mutation and provisioning tools that pass... L162: `);process.stderr.write("\nRun `mcp-diggo doctor` to verify the installation.\n")}var x5;var WG=S(()=>{xv();G4();j4();av();On();x5=["opencode.json","opencode.jsonc"]});function O(n... L163: `)}var EG=(n,

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

mcp-bundle/dist/cli.jsView on unpkg · L149

161`),!g.DESTRUCTIVE_TOOLS_ENABLED)process.stderr.write(`Destructive tools disabled. The MCP server will have a reduced-risk write inventory: mutation and provisioning tools that pass... L162: `);process.stderr.write("\nRun `mcp-diggo doctor` to verify the installation.\n")}var x5;var WG=S(()=>{xv();G4();j4();av();On();x5=["opencode.json","opencode.jsonc"]});function O(n... L163: `)}var EG=(n,i)=>{n.name="$ZodError",Object.defineProperty(n,"_zod",{value:n._zod,enumerable:!1}),Object.defineProperty(n,"issues",{value:i,enumerable:!1}),n.message=JSON.stringify...

Low

Eval

Package source references a known benign dynamic code generation pattern.

mcp-bundle/dist/cli.jsView on unpkg · L161