Loading npm security reports…

@extenshi/mcp: Suspicious npm security report (Warn) | LPM Firewall

registry / @extenshi/mcp / 0.2.0

@extenshi/mcp@0.2.0

Extenshi MCP server — bring the extension catalog (search, security, market research) and pre-publish scanning into your AI tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 113 KB of source, external domains: auth.extenshi.io, bff.extenshi.io, docs.extenshi.io, dojo.extenshi.io, eu.i.posthog.com, registry.npmjs.org, scan.extenshi.io

Source & flagged code

3 flagged

package.jsonView file

Lines 37-77json

37 "types": "./dist/index.d.ts",

38 "default": "./dist/index.js"

39 },

40 "./tools": {

41 "types": "./dist/tools.d.ts",

42 "default": "./dist/tools.js"

43 },

44 "./bff": {

45 "types": "./dist/bff.d.ts",

46 "default": "./dist/bff.js"

47 }

48 },

49 "files": [

50 "dist",

51 "scripts/postinstall.cjs"

52 ],

53 "scripts": {

54 "build": "tsc",

55 "dev": "tsc --watch",

56 "test": "vitest run",

57 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "prepublishOnly": "yarn build"

59 },

60 "dependencies": {

61 "@extenshi/publisher": "^0.8.0",

62 "@trpc/client": "^11.17.0",

63 "@trpc/server": "^11.17.0",

64 "fastmcp": "^4.0.1",

65 "posthog-node": "^5.35.1",

66 "undici": "^7.28.0",

67 "zod": "^3.25.76"

68 },

69 "devDependencies": {

70 "@types/node": "^22.16.5",

71 "typescript": "^5.8.3",

72 "vitest": "^3.2.4"

73 },

74 "engines": {

75 "node": ">=20"

76 }

77}

dist/index.jsView file

Lines 8-48javascript

8 * local `publish_extension`.

9 *

10 * The TOOLS themselves live in `tools.ts` (transport-agnostic) so the sibling

11 * remote OAuth server (`@extenshi/mcp-server`

Source & flagged code

3 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code