registry / @javascribe/pindoupic / 0.5.1

@javascribe/pindoupic@0.5.1

pindoupic 拼豆图纸生成器 — CLI + MCP Server 双模式；色板与预设内置，算法代码加密分发、密钥由 pindoupic.com 下发

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The MCP executable contains an opaque encrypted algorithm that is unlocked by a remote key and dynamically executed. No confirmed data theft or install-time attack was identified.

Static reason

No blocking static signals were detected.

Trigger

A user invokes bead-pattern generation through the MCP server.

Impact

The executable behavior cannot be statically audited while the remote key enables its opaque payload.

Mechanism

The runtime fetches a key, decrypts dist/core.enc.json, and evaluates the decrypted source.

AI rationale

This is an active remote-key-gated opaque code path executed during normal use, so its behavior cannot be verified by static review. The absence of an install lifecycle hook and confirmed exfiltration makes a warning more proportionate than a block.

Evidence

dist/mcp.jsdist/core.enc.json

Network endpoints1

www.pindoupic.com/api/v1/crypto/algo-key

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The manifest declares encrypted algorithm distribution with a remotely supplied key and exposes MCP and CLI executables.
The MCP runtime requests an algorithm key from the configured service.
It decrypts bundled content and executes the resulting text with the Function constructor.
Pattern generation awaits that decrypted module before processing input.

Evidence against

The manifest has no preinstall, install, or postinstall lifecycle hook.
The inspected MCP path contains no credential collection or transmission.

Behavioral surface

Source

EnvironmentVarsEvalNetwork

Supply chain

MinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 406 KB of source, external domains: www.pindoupic.com, www.w3.org

Source & flagged code

6 flagged

dist/mcp.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2import{Server as W2}from"@modelcontextprotocol/sdk/server/index.js";import{StdioServerTransport as O2}from"@modelcontextprotocol/sdk/server/stdio.js";import{CallToolRequestSchema as U2,ListToolsRequestSchema as Q2}from"@modelcontextprotocol/sdk/types.js";import P2 from"sharp";import Me from"sharp";var L=class{width;height;_pixels;constructor(a,e,_){this.width=a,this.height=e,this._pixels=_||null}getContext(a,e){return new ne(this)}},ne=class{_canvas;imageSmoothingEnabled=!0;imageSmoothingQuality="high";constructor(a){this._canvas=a}getImageData(a,e,_,d){let h=this._canvas._pixels;return{data:h ...

Medium

Ai Review Evidence

The MCP runtime requests an algorithm key from the configured service.

dist/mcp.jsView on unpkg · L2

3return ${M2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u672A\u5BFC\u51FA\u9884\u671F\u63A5\u53E3\uFF09");return H})(),z.catch(()=>{z=null}),z)}var z=null;var Ve="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAAC4jAAAuIwF4pT92AAAOvUlEQVR4nO2dz2scyRXHjf8G2xDv2fsPJGcHsxIsrKdjjX5DzsvuzNqQ80KMLJFLYoWFWJBDQFrYfyAHiUDAWN1jyWzXqCcsgoVcpT0FNCNdAosqvNGM1ZG7Z6alnq6ars8H6tr1eO/1t350db1btwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgtOgvvrina7U1X ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp.jsView on unpkg · L1

Medium

Ai Review Evidence

It decrypts bundled content and executes the resulting text with the Function constructor.

dist/mcp.jsView on unpkg · L2

Medium

Ai Review Evidence

Pattern generation awaits that decrypted module before processing input.

dist/mcp.jsView on unpkg · L3

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L1

4`)}let Be=Math.max(9,Math.floor(6*A)),ve=Math.max(20,Math.floor(Be*2.6)),de=S+w+De+_2+be+ve,n

5`),oe=await P2(Buffer.from(h2)).png().toBuffer();if(G==="pdf"){let{execSync:i}=await import("node:child_process"),{mkdtempSync:x,writeFileSync:s,readFileSync:g,rmSync:b}=await import("node:fs"),{tmpdir:p}=await import("node:os"),{join:f}=await import("node:path"),k=x(f(p(),"pindoupic-pdf-")),K=f(k,"temp.png"),$=f(k,"output.pdf");try{return s(K,oe),i(`sips -s format pdf "${K}" --out "${$}"`,{timeout:1e4}),g($)}catch(Z){return console.error(`\u26A0 PDF conversion failed: ${Z.message}. Falling back

7\u53C2\u6570\uFF1A

8- image_url / image_base64 / image_path: \u56FE\u7247\u6765\u6E90\uFF08\u4E09\u9009\u4E00\uFF0C\u672C\u673A\u6587\u4EF6\u63A8\u8350\u7528 image_path\uFF09

9- width: \u56FE\u7EB8\u5BBD\u5EA6 ${B.min}-${B.max}\uFF08\u9ED8\u8BA4 ${J.default_width}\uFF0C\u53EF\u7531\u540E\u53F0\u53C2\u6570\u8986\u76D6\uFF09

10- palette_brand: \u8272\u677F\u54C1\u724C\uFF08\u9ED8\u8BA4 MARD\uFF09

11- palette_sub: \u8272\u677F\u578B\u53F7\uFF08\u9ED8\u8BA4 291\uFF0C\u53EF\u9009\u503C\u89C1 list_palettes\uFF09

12- image_type: \u56FE\u7247\u7C7B\u578B\u9884\u8BBE\uFF08\u9ED8\u8BA4 miniapp_fast \u5C0F\u7A0B\u5E8F\u6781\u901F\u6A21\u5F0F\uFF09\uFF1A${U.map(r=>r.id).join("|")}`,inputSchema:{type:"object",properties:{image_url:{type:"string",description:"\u56FE\u7247 URL\uFF08\u4E0E image_base64 / image_path \u4E09\u9009\u4E00\uFF09

Long lines were clipped for display.

package.jsonView file

Lines 1-22json

2 "name": "@javascribe/pindoupic",

3 "version": "0.5.1",

4 "description": "pindoupic 拼豆图纸生成器 — CLI + MCP Server 双模式；色板与预设内置，算法代码加密分发、密钥由 pindoupic.com 下发",

5 "type": "module",

Source & flagged code

6 flagged · loading source

dist/mcp.jsView file

1#!/usr/bin/env node L2: import{Server as W2}from"@[redacted].js";import{StdioServerTransport as O2}from"@[redacted].js";import{CallToolRequestSchema a... L3: return ${M2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u672A\u5BFC\u51FA\u988...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp.jsView on unpkg · L1

2ort.meta.url),"utf8"),a;try{a=await fetch(`${re}/crypto/algo-key`,{signal:AbortSignal.timeout(8e3)})}catch(v){throw new Error(`\u65E0\u6CD5\u8FDE\u63A5 pindoupic.com \u83B7\u53D6\u7B97\u6CD5\u5BC6\u94A5\uFF08${v?.name||v?.message}\uFF09\u3002\u672C\u5DE5\u5177

Medium

Ai Review Evidence

The MCP runtime requests an algorithm key from the configured service.

dist/mcp.jsView on unpkg · L2

2er.from(e,"hex"),Buffer.from(_,"hex"));o.setAuthTag(Buffer.from(h,"hex"));let F=Buffer.concat([o.update(Buffer.from(d,"hex")),o.final()]).toString("utf8"),H=new Function(`${F} return ${M2};`)();if(!H||typeof H.generatePattern!="fu

Medium

Ai Review Evidence

It decrypts bundled content and executes the resulting text with the Function constructor.

dist/mcp.jsView on unpkg · L2

3let{generatePattern:e,buildColorStats:_,rgbToLab:d,simplifyColors:h}=await Qe(),o=await ye(r.input),F=await Pe(o,a,r.resizeMode||"smooth"),{rgb:H,alpha:v}=Re(F.pixels,F.width,F.height),G=new L(F.width,F.height,F.pixels),Q=r.palett

Medium

Ai Review Evidence

Pattern generation awaits that decrypted module before processing input.

dist/mcp.jsView on unpkg · L3

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L1

package.jsonView file

2"name": "@javascribe/pindoupic", "version": "0.5.1", "description": "pindoupic 拼豆图纸生成器 — CLI + MCP Server 双模式；色板与预设内置，算法代码加密分发、密钥由 pindoupic.com 下发", "type": "module", "bin": { "

Medium

Ai Review Evidence

The manifest declares encrypted algorithm distribution with a remotely supplied key and exposes MCP and CLI executables.

package.jsonView on unpkg · L2

Findings

1 High6 Medium3 Low

HighSame File Env Network Executiondist/mcp.js

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencepackage.json

MediumAi Review Evidencedist/mcp.js

LowScripts Present

LowEvaldist/mcp.js

LowUrl Strings

Affected versions and remediation

This report applies to @javascribe/pindoupic@0.5.1.

See version security history for other recorded verdicts.

Review the evidence and your use of @javascribe/pindoupic@0.5.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 08:09:50.259Z (UTC).

91%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeStaged Payload Carrier

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Maintainersjavascribe

Version0.5.1

Latest on npm0.8.0

PublishedSep 27, 2026

LicenseMIT

Dependencies2

Integrityverified

Package size161 KB

Files9

Keywords拼豆图纸拼豆图案图片转拼豆图片转拼豆图纸拼豆图纸生成器拼豆图纸转换器拼豆图纸制作工具拼豆图纸免费生成器

LinksHomepage Issues

Runtime surface

package.json

Entrypointsbin → pindoupic, pindoupic-mcp

Runtimenode >=20

Artifact573 KB · 9 files2 signature(s)

Install lifecycleNo install hooks · other: build, mcp, prepack, start

Behavioral surface

EnvironmentVarsEvalNetworkMinifiedPossibleObfuscationUrlStringsManifest: clean