registry  /  @dom-pointer-mcp/server  /  1.6.1

@dom-pointer-mcp/server@1.6.1

MCP Server for DOM element pointing - WebSocket bridge for element targeting

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork
Supply chain
HighEntropyStringsObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 1.63 MB of source, external domains: dom.spec.whatwg.org, github.com, html.spec.whatwg.org, html5sec.org, jsperf.com, mathiasbynens.be

Source & flagged code

4 flagged · loading source
dist/cli.cjsView file
936var EventEmitter = require("events").EventEmitter; L937: var childProcess = require("child_process"); L938: var path12 = require("path");
High
Child Process

Package source references child process execution.

dist/cli.cjsView on unpkg · L936
24127try { L24128: (0, import_child_process.execSync)(`claude mcp remove ${MCP_SERVER_NAME} -s user`, { stdio: "pipe" }); L24129: } catch { L24130: } L24131: const cmdArgs = launchMode === "global" ? "dom-pointer-mcp start" : "npx -y @dom-pointer-mcp/server@latest start"; L24132: (0, import_child_process.execSync)(
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.cjsView on unpkg · L24127
21849patternName = generic_password severity = medium line = 21849 matchedText = password...d]",
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/cli.cjsView on unpkg · L21849
38* Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L117: /** L118: * @api private L119: */ ... L936: var EventEmitter = require("events").EventEmitter; L937: var childProcess = require("child_process"); L938: var path12 = require("path"); ... L985: this._outputConfiguration = { L986: writeOut: (str) => process5.stdout.write(str), L987: writeErr: (str) => process5.stderr.write(str),
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.cjsView on unpkg · L38

Findings

2 High4 Medium6 Low
HighChild Processdist/cli.cjs
HighRuntime Package Installdist/cli.cjs
MediumSecret Patterndist/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/cli.cjs
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings