registry / @hostinger/mcp / 3.23.0
@hostinger/mcp@3.23.0
MCP server for Hostinger API
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged child-process use is a development TypeScript build, while the added OAuth code implements a browser-based Hostinger sign-in flow. The inspected bootstrap handles authentication only when invoked; no install-time exfiltration or unrelated execution was found.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Server startup, a user-requested API tool call, or explicit invocation of the headless connect bootstrap.
Impact
No malicious impact identified in the inspected source.
Mechanism
The server uses Hostinger's API and OAuth endpoints; OAuth login opens a browser and completes through a localhost callback.
AI rationale
The flagged child-process use is a development TypeScript build, while the added OAuth code implements a browser-based Hostinger sign-in flow. The inspected bootstrap handles authentication only when invoked; no install-time exfiltration or unrelated execution was found.
Evidence
~/.config/hostinger-mcp/credentials.json%APPDATA%/hostinger-mcp/credentials.json
Network endpoints2
auth.hostinger.comdevelopers.hostinger.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has no install lifecycle scripts; its declared scripts are start, build, and start:ts.
- OAuth uses Hostinger's auth.hostinger.com issuer and opens a browser for the authorization flow.
- The headless bootstrap checks for existing authentication and starts login only when none is found.
Evidence against
- build.js runs npx tsc and copies build artifacts; it does not download or execute an unrelated payload.
- OAuth credentials are used in Hostinger's OAuth flow and saved under the hostinger-mcp configuration directory.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggedbuild.jsView file
2L3: import { exec } from 'child_process';
L4: import fs from 'fs';
High
18console.log('Compiling TypeScript...');
L19: exec('npx tsc', (error, stdout, stderr) => {
L20: if (error) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
build.jsView on unpkg · L18skills/headless/connect/bootstrap.mjsView file
•matchType = normalized_sha256
matchedPackage = hostinger-api-mcp@3.5.0
matchedPath = [redacted].mjs
matchedIdentity = npm:aG9zdGluZ2VyLWFwaS1tY3A:3.5.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltasrc/core/oauth.js
HighChild Processbuild.js
HighShell
HighRuntime Package Installbuild.js
HighKnown Malware Source Similarityskills/headless/connect/bootstrap.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hostinger/mcp@3.23.0.
See all versions of @hostinger/mcp for other recorded verdicts.
- Review the evidence and your use of @hostinger/mcp@3.23.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.