registry / @hover-dev/mcp / 0.42.0

@hover-dev/mcp@0.42.0

Hover MCP server — grounded browser actuation + crystallize a Playwright suite, for your own coding agent

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 94.4 KB of source, external domains: cloud.gethover.dev

Source & flagged code

2 flagged

dist/hook.jsView file

Lines 100-140javascript

100 });

101 } catch {

102 emit({});

103 }

104}

105var GATE_MAX_SPECS = 12;

106var GATE_CDP_URL = `http://localhost:${process.env.HOVER_CDP_PORT || 9222}`;

107async function verifyGate(cwd) {

108 try {

109 const dir = join(cwd, ".hover", "sidecars");

110 const { readdir } = await import("fs/promises");

111 const files = (await readdir(dir).catch(() => [])).filter((f) => f.endsWith(".json"));

112 if (!files.length) return null;

113 const { readSidecar, replayOnPage, launchDebugChrome } = await import("@hover-dev/core/engine");

114 loadHoverEnvFile(cwd);

115 const target = process.env.HOVER_TARGET || readActiveEnv(cwd)?.url || "http://localhost:5173";

116 try {

117 await fetch(target, { signal: AbortSignal.timeout(2e3), redirect: "manual" });

118 } catch {

119 return null;

120 }

121 const { chromium } = await import("playwright-core");

122 let browser;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hook.jsView on unpkg · L120

123 try {

124 browser = await chromium.connectOverCDP(GATE_CDP_URL, { timeout: 1500 });

125 } catch {

126 await launchDebugChrome({ port: Number(process.env.HOVER_CDP_PORT || 9222), url: target });

127 browser = await chromium.connectOverCDP(GATE_CDP_URL, { timeout: 8e3 });

128 }

129 try {

130 const ctx = browser.contexts()[0] ?? await browser.newContext();

131 const page = ctx.pages()[0] ?? await ctx.newPage();

132 const slugs = files.map((f) => f.replace(/\.json$/, "")).sort().slice(0, GATE_MAX_SPECS);

133 const red = [];

134 let verified = 0;

135 for (const slug of slugs) {

136 const sc = await readSidecar(cwd, slug);

137 if (!sc) continue;

138 if ((sc.redactionEnvVars ?? []).some((v) => process.env[v] === void 0)) continue;

139 const res = await replayOnPage(page, target, sc.steps);

140 verified++;

dist/mcp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @hover-dev/mcp@0.40.0 matchedIdentity = npm:QGhvdmVyLWRldi9tY3A:0.40.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/hook.jsView file

120package = @hover-dev/mcp; repositoryIdentity = hover; dependency = playwright-core L120: } L121: const { chromium } = await import("playwright-core"); L122: let browser;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hook.jsView on unpkg · L120

dist/mcp.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp.jsView on unpkg

Findings

2 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/hook.js

HighPrevious Version Dangerous Deltadist/mcp.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/hook.jsView file

Lines 100-140javascript

100 });

101 } catch {

102 emit({});

103 }

104}

105var GATE_MAX_SPECS = 12;

106var GATE_CDP_URL = `http://localhost:${process.env.HOVER_CDP_PORT || 9222}`;

107async function verifyGate(cwd) {

108 try {

109 const dir = join(cwd, ".hover", "sidecars");

110 const { readdir } = await import("fs/promises");

111 const files = (await readdir(dir).catch(() => [])).filter((f) => f.endsWith(".json"));

112 if (!files.length) return null;

113 const { readSidecar, replayOnPage, launchDebugChrome } = await import("@hover-dev/core/engine");

114 loadHoverEnvFile(cwd);

115 const target = process.env.HOVER_TARGET || readActiveEnv(cwd)?.url || "http://localhost:5173";

116 try {

117 await fetch(target, { signal: AbortSignal.timeout(2e3), redirect: "manual" });

118 } catch {

119 return null;

120 }

121 const { chromium } = await import("playwright-core");

122 let browser;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hook.jsView on unpkg · L120

123 try {

124 browser = await chromium.connectOverCDP(GATE_CDP_URL, { timeout: 1500 });

125 } catch {

126 await launchDebugChrome({ port: Number(process.env.HOVER_CDP_PORT || 9222), url: target });

127 browser = await chromium.connectOverCDP(GATE_CDP_URL, { timeout: 8e3 });

128 }

129 try {

130 const ctx = browser.contexts()[0] ?? await browser.newContext();

131 const page = ctx.pages()[0] ?? await ctx.newPage();

132 const slugs = files.map((f) => f.replace(/\.json$/, "")).sort().slice(0, GATE_MAX_SPECS);

133 const red = [];

134 let verified = 0;

135 for (const slug of slugs) {

136 const sc = await readSidecar(cwd, slug);

137 if (!sc) continue;

138 if ((sc.redactionEnvVars ?? []).some((v) => process.env[v] === void 0)) continue;

139 const res = await replayOnPage(page, target, sc.steps);

140 verified++;

dist/mcp.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp.jsView on unpkg