registry / @hostinger/mcp / 2.9.1
@hostinger/mcp@2.9.1
MCP server for Hostinger API
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe scanner’s execution signal resolves to an explicit build command that invokes the compiler, and the manifest has no install lifecycle hook. Inspected credential transport targets the configured API base URL, defaulting to Hostinger, while OAuth defaults to Hostinger’s authentication service.
Static reason
One or more suspicious static signals were detected.
Trigger
The build behavior runs when the build command is explicitly invoked; runtime API requests occur when MCP operations are called.
Impact
No malicious effect was established from the inspected behavior.
Mechanism
The build invokes the TypeScript compiler and copies build inputs. Runtime requests attach authentication to API URLs based on the configured base URL, which defaults to Hostinger.
AI rationale
The scanner’s execution signal resolves to an explicit build command that invokes the compiler, and the manifest has no install lifecycle hook. Inspected credential transport targets the configured API base URL, defaulting to Hostinger, while OAuth defaults to Hostinger’s authentication service.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to Hostinger MCP server entrypoints and lists start and build commands, with no install lifecycle hook.
- The build script runs the TypeScript compiler and copies build inputs into the output directory.
- Runtime upload requests attach a bearer token to URLs built from the configured API base URL; the default is Hostinger’s developer API.
- OAuth uses Hostinger’s auth service by default and returns through a local callback.
Evidence against
- The flagged child process use is in the explicit build script and runs the TypeScript compiler; no install-time execution was found.
- The inspected credential requests target the configured Hostinger API base URL, whose default is developers.hostinger.com.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggedbuild.jsView file
2L3: import { exec } from 'child_process';
L4: import fs from 'fs';
High
18console.log('Compiling TypeScript...');
L19: exec('npx tsc', (error, stdout, stderr) => {
L20: if (error) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
build.jsView on unpkg · L18package.jsonView file
18"type": "module",
"main": "./src/servers/all.js",
"bin": {
"hostinger-api-mcp": "./src/servers/all.js",
"hostinger-agency-hosting-mcp": "./src/servers/agency-hosting.js",
"hostinger-billing-mcp": "./src/servers/billing.js",
"hos
Low
Suspicious Lifecycle Evidence
The manifest points to Hostinger MCP server entrypoints and lists start and build commands, with no install lifecycle hook.
Findings
3 High3 Medium6 Low
HighChild Processbuild.js
HighShell
HighRuntime Package Installbuild.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @hostinger/mcp@2.9.1.
See all versions of @hostinger/mcp for other recorded verdicts.
- Review the evidence and your use of @hostinger/mcp@2.9.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.