registry / @hostinger/mcp / 3.4.2
@hostinger/mcp@3.4.2
MCP server for Hostinger API
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe source shows a caller-invoked MCP server whose API base defaults to developers.hostinger.com. The scanner's runtime-install signal maps to an explicit build script, and the inspected package manifests contain no preinstall, install, or postinstall trigger.
Static reason
One or more suspicious static signals were detected.
Trigger
An MCP client sends a tool request.
Impact
No confirmed malicious impact; requests perform the selected API operation.
Mechanism
The server constructs an API request from the selected tool and arguments, using the configured base URL and bearer token.
AI rationale
The source shows a caller-invoked MCP server whose API base defaults to developers.hostinger.com. The scanner's runtime-install signal maps to an explicit build script, and the inspected package manifests contain no preinstall, install, or postinstall trigger.
Evidence
package.jsonbuild.jssrc/servers/all.jssrc/core/runtime.jssrc/core/tools/all.js
Network endpoints1
developers.hostinger.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines start and build scripts but no preinstall, install, or postinstall hook; build.js invokes the TypeScript compiler when the build script runs.
- The executable entry starts the Hostinger MCP server with generated tools, and tool requests arrive with a caller-supplied name and arguments.
- Runtime requests use the configured API base URL, which defaults to developers.hostinger.com, and attach the bearer token to that API request.
- The inspected SDK files implement MCP protocol schemas and stdio/HTTP transport. The inspected axios and cors sources provide HTTP client cancellation and CORS middleware; their manifests have no preinstall, install, or postinstall scripts.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggedbuild.jsView file
2L3: import { exec } from 'child_process';
L4: import fs from 'fs';
High
18console.log('Compiling TypeScript...');
L19: exec('npx tsc', (error, stdout, stderr) => {
L20: if (error) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
build.jsView on unpkg · L1817// Run TypeScript compiler
console.log('Compiling TypeScript...');
exec('npx tsc', (error, stdout, stderr) => {
if (error) {
console.error('Error compiling TypeScript:', error);
console.error(stderr);
process.exit(1);
}
if
Low
Suspicious Lifecycle Evidence
package.json defines start and build scripts but no preinstall, install, or postinstall hook; build.js invokes the TypeScript compiler when the build script runs.
build.jsView on unpkg · L17Findings
3 High3 Medium6 Low
HighChild Processbuild.js
HighShell
HighRuntime Package Installbuild.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencebuild.js
Affected versions and remediation
This report applies to @hostinger/mcp@3.4.2.
See all versions of @hostinger/mcp for other recorded verdicts.
- Review the evidence and your use of @hostinger/mcp@3.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.