registry / @hostinger/mcp / 3.24.0
@hostinger/mcp@3.24.0
MCP server for Hostinger API
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install lifecycle scripts, and the flagged process execution is limited to the user-invoked TypeScript build and an explicitly run sign-in helper. The runtime's inspected API and OAuth destinations are Hostinger services, consistent with the package's stated purpose.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Users start an MCP entry point, invoke the build script, or explicitly run the headless sign-in helper.
Impact
No malicious impact identified in the inspected source.
Mechanism
The server sends authenticated API requests to its configured Hostinger API endpoint and uses Hostinger OAuth; the build script invokes the TypeScript compiler.
AI rationale
The manifest has no install lifecycle scripts, and the flagged process execution is limited to the user-invoked TypeScript build and an explicitly run sign-in helper. The runtime's inspected API and OAuth destinations are Hostinger services, consistent with the package's stated purpose.
Network endpoints2
developers.hostinger.comauth.hostinger.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes Hostinger MCP server entry points and has no lifecycle scripts.
- The build script runs `npx tsc` when the user invokes the build script.
- The main entry point starts the MCP server with its tools, instructions, and skills.
- The runtime defaults API requests to `developers.hostinger.com`; OAuth uses `auth.hostinger.com`.
- The headless helper uses fixed `npx` arguments to check the MCP version and, when run, start the documented browser sign-in flow.
Evidence against
- The package includes child-process execution and network access, but the inspected uses support compilation, Hostinger API calls, and sign-in.
- The headless sign-in helper checks local auth state and only launches its login flow when no usable credentials are found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flaggedbuild.jsView file
2L3: import { exec } from 'child_process';
L4: import fs from 'fs';
High
18console.log('Compiling TypeScript...');
L19: exec('npx tsc', (error, stdout, stderr) => {
L20: if (error) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
build.jsView on unpkg · L18skills/headless/connect/bootstrap.mjsView file
•matchType = normalized_sha256
matchedPackage = @hostinger/mcp@3.15.1
matchedPath = [redacted].mjs
matchedIdentity = npm:QGhvc3Rpbmdlci9tY3A:3.15.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
6 High3 Medium4 Low
HighChild Processbuild.js
HighShell
HighRuntime Package Installbuild.js
HighKnown Malware Source Similarityskills/headless/connect/bootstrap.mjs
HighKnown Malware Source Similarityskills/headless/steps/05-design/logo-kit.mjs
HighKnown Malware Source Similaritysrc/core/skills.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hostinger/mcp@3.24.0.
See all versions of @hostinger/mcp for other recorded verdicts.
- Review the evidence and your use of @hostinger/mcp@3.24.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.