registry / @hostinger/mcp / 2.16.0
@hostinger/mcp@2.16.0
MCP server for Hostinger API
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and build.js runs a compiler only as an explicit build task. Runtime bearer-token requests use Hostinger API paths and are triggered by tool execution; the scanner’s execution and network signals do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
An MCP client invokes an execute tool or a hosting upload operation.
Impact
No unauthorized transfer or other confirmed attack effect was found.
Mechanism
The runtime sends bearer-authenticated requests to API paths built from the configured API base URL, which defaults to Hostinger.
AI rationale
The manifest has no install lifecycle hook, and build.js runs a compiler only as an explicit build task. Runtime bearer-token requests use Hostinger API paths and are triggered by tool execution; the scanner’s execution and network signals do not establish malicious behavior.
Evidence
package.jsonbuild.jssrc/core/runtime.js
Network endpoints1
developers.hostinger.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists start, build, and start:ts scripts; none is an install lifecycle hook.
- build.js runs the TypeScript compiler and copies project files when the build script is invoked.
- The API base defaults to developers.hostinger.com, and API requests use that base URL with the bearer token.
- Upload credential requests use Hostinger API paths, attach the bearer token, and send through axios.
- API execution is reached through an MCP execute request.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggedbuild.jsView file
2L3: import { exec } from 'child_process';
L4: import fs from 'fs';
High
18console.log('Compiling TypeScript...');
L19: exec('npx tsc', (error, stdout, stderr) => {
L20: if (error) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
build.jsView on unpkg · L18package.jsonView file
35"scripts": {
"start": "node src/servers/all.js",
"build": "node build.js",
"start:ts": "npx tsc && node dist/src/servers/all.js"
},
Low
Suspicious Lifecycle Evidence
package.json lists start, build, and start:ts scripts; none is an install lifecycle hook.
package.jsonView on unpkg · L35Findings
3 High3 Medium6 Low
HighChild Processbuild.js
HighShell
HighRuntime Package Installbuild.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/core/runtime.js
Affected versions and remediation
This report applies to @hostinger/mcp@2.16.0.
See all versions of @hostinger/mcp for other recorded verdicts.
- Review the evidence and your use of @hostinger/mcp@2.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.