@groundtruth-mcp/gt-mcp@7.5.0: Malicious npm security report

Loading npm security reports…

Source & flagged code

4 flagged

Lines 1-37json

2 "name": "@groundtruth-mcp/gt-mcp",

3 "mcpName": "io.github.rm-rf-prod/groundtruth",

4 "version": "7.5.0",

5 "description": "Enterprise-grade MCP server for live docs, best practices, code audit. Context7 alternative — 598+ libraries, evidence-verified answers (never generic), smart dispatch (use gt mcp), plain-text intent routing, telemetry, SSRF-hardened multi-source fetcher, atomic disk cache, IPv6 + Unicode-homoglyph defenses.",

6 "type": "module",

7 "main": "dist/index.js",

8 "bin": {

9 "@groundtruth-mcp/gt-mcp": "dist/index.js",

10 "gt-mcp": "dist/index.js"

11 },

12 "files": [

13 "dist",

14 "postinstall.mjs"

15 ],

16 "scripts": {

17 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "build": "tsc && find dist -name '*.js.map' -delete && find dist -name '*.d.ts' -delete && javascript-obfuscator dist --output dist --compact true --string-array true --string-array-encoding rc4 --string-array-threshold 0.9 --split-strings true --split-strings-chunk-length 10",

19 "build:publish": "node scripts/swap-private.mjs && npm run build; EXIT=$?; node scripts/revert-private.mjs; exit $EXIT",

20 "dev": "tsx watch src/index.ts",

21 "start": "node dist/index.js",

22 "clean": "rm -rf dist",

23 "update-stats": "node scripts/update-stats.mjs",

24 "prepublishOnly": "npm run clean && npm run build:publish && npm run update-stats",

25 "test": "vitest run",

26 "test:coverage": "vitest run --coverage",

27 "typecheck": "tsc --noEmit",

28 "lint": "eslint src",

29 "version": "node scripts/update-version.mjs && node scripts/update-changelog.mjs && npm run update-stats && git add src/constants.ts CHANGELOG.md README.md server.json package.json llms.txt",

30 "postversion": "git push && git push origin \"v$(node -p 'require(\"./package.json\").version')\" && node scripts/create-release.mjs",

31 "release": "npm run typecheck && npm run test && npm version minor && npm publish --access public && mcp-publisher publish",

32 "release:patch": "npm run typecheck && npm run test && npm version patch && npm publish --access public && mcp-publisher publish",

33 "release:major": "npm run typecheck && npm run test && npm version major && npm publish --access public && mcp-publisher publish"

34 },

35 "engines": {

36 "node": ">=22"

37 },

dist/server/http.jsView file

Lines 1-1javascript

1const a4_0x29e989=a4_0x34dd;(function(_0x4eee60,_0x2fb2b5){const _0x2448ad=a4_0x34dd,_0x30ce33=_0x4eee60();while(!![]){try{const _0x4bfe7a

dist/constants.jsView file

Lines 1-1javascript

1const a1_0x498d06=a1_0x3f0e;(function(_0x55b24a,_0x139bfa){const _0x492f40=a1_0x3f0e,_0x56cdf7=_0x55b24a();while(!![]){try{const _0x5e249c

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/server/http.jsView file

1const a4_0x29e989=a4_0x34dd;(function(_0x4eee60,_0x2fb2b5){const _0x2448ad=a4_0x34dd,_0x30ce33=_0x4eee60();while(!![]){try{const _0x4bfe7a=parseInt(_0x2448ad(0x9b,'2leI'))/0x1*(-pa...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/http.jsView on unpkg · L1

@groundtruth-mcp/gt-mcp@7.5.0: Malicious npm security report | LPM Firewall

Source & flagged code

4 flagged

package.jsonView file

Lines 1-37json

2 "name": "@groundtruth-mcp/gt-mcp",

3 "mcpName": "io.github.rm-rf-prod/groundtruth",

4 "version": "7.5.0",

6 "type": "module",

7 "main": "dist/index.js",

8 "bin": {

9 "@groundtruth-mcp/gt-mcp": "dist/index.js",

10 "gt-mcp": "dist/index.js"

11 },

12 "files": [

13 "dist",

14 "postinstall.mjs"

15 ],

16 "scripts": {

17 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

19 "build:publish": "node scripts/swap-private.mjs && npm run build; EXIT=$?; node scripts/revert-private.mjs; exit $EXIT",

20 "dev": "tsx watch src/index.ts",

21 "start": "node dist/index.js",

22 "clean": "rm -rf dist",

23 "update-stats": "node scripts/update-stats.mjs",

24 "prepublishOnly": "npm run clean && npm run build:publish && npm run update-stats",

25 "test": "vitest run",

26 "test:coverage": "vitest run --coverage",

27 "typecheck": "tsc --noEmit",

28 "lint": "eslint src",

29 "version": "node scripts/update-version.mjs && node scripts/update-changelog.mjs && npm run update-stats && git add src/constants.ts CHANGELOG.md README.md server.json package.json llms.txt",

30 "postversion": "git push && git push origin \"v$(node -p 'require(\"./package.json\").version')\" && node scripts/create-release.mjs",

31 "release": "npm run typecheck && npm run test && npm version minor && npm publish --access public && mcp-publisher publish",

32 "release:patch": "npm run typecheck && npm run test && npm version patch && npm publish --access public && mcp-publisher publish",

33 "release:major": "npm run typecheck && npm run test && npm version major && npm publish --access public && mcp-publisher publish"

34 },

35 "engines": {

36 "node": ">=22"

37 },

dist/server/http.jsView file

Lines 1-1javascript

1const a4_0x29e989=a4_0x34dd;(function(_0x4eee60,_0x2fb2b5){const _0x2448ad=a4_0x34dd,_0x30ce33=_0x4eee60();while(!![]){try{const _0x4bfe7a

dist/constants.jsView file

Lines 1-1javascript

1const a1_0x498d06=a1_0x3f0e;(function(_0x55b24a,_0x139bfa){const _0x492f40=a1_0x3f0e,_0x56cdf7=_0x55b24a();while(!![]){try{const _0x5e249c

@groundtruth-mcp/gt-mcp@7.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code