@immersivecommons/mcp: Suspicious npm security report (Warn)

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.25 KB of source, external domains: www.immersivecommons.com

Source & flagged code

1 flagged

bin.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * @immersivecommons/mcp — stdio bridge to the hosted Immersive Commons MCP

4 * server (Streamable HTTP). Lets stdio-only MCP clients (Claude Desktop,

5 * Cursor, Windsurf, ...) connect with one command:

6 *

7 * npx -y @immersivecommons/mcp

8 *

9 * Auth is optional: 10 tools are public; everything else needs a per-user

Source & flagged code

1 flagged · loading source

bin.jsView file

10* `agt_` bearer token (human-approved device-code flow — an agent cannot L11: * self-mint; see https://www.immersivecommons.com/auth.md). Pass it via: L12: * ... L18: "use strict"; L19: const { spawnSync } = require("node:child_process"); L20: ... L23: const args = ["-y", "mcp-remote@0", SERVER_URL]; L24: const token = process.env.IC_AGENT_TOKEN; L25: if (token) { ... L30: L31: const r = spawnSync(process.platform === "win32" ? "npx.cmd" : "npx", args, { L32: stdio: "inherit",

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code