registry  /  @hyperfixi/mcp-server  /  2.7.1

@hyperfixi/mcp-server@2.7.1

Model Context Protocol server for HyperFixi hyperscript development

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 4 file(s), 526 KB of source, external domains: unpkg.com

Source & flagged code

2 flagged · loading source
dist/index.jsView file
464package = @hyperfixi/mcp-server; repositoryIdentity = hyperfixi; dependency = @hyperfixi/patterns-reference L464: try { L465: patternsRef = await import("@hyperfixi/patterns-reference"); L466: } catch {
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L464
669task: "submit form with fetch", L670: code: 'on submit prevent default fetch /api { method: "POST", body: me as FormData }', L671: category: "async" ... L6783: try { L6784: spec = JSON.parse(result.code); L6785: } catch { ... L8604: function findGrailYaml(cwd) { L8605: return process.env.GRAIL_YAML ?? `${cwd}/grail.yaml`; L8606: } ... L8608: // src/tools/grail-registry.ts L8609: import { exec } from "child_process"; L8610: var MAX_OUTPUT = 500;
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L669

Findings

1 High3 Medium5 Low
HighCopied Package Dependency Bridgedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings