registry / @mp3wizard/figma-console-mcp / 1.32.3

@mp3wizard/figma-console-mcp@1.32.3

The most comprehensive MCP server for Figma — design tokens, variables, components, write tools, version history diff, accessibility audits, FigJam, Slides, and more. Local (WebSocket Desktop Bridge plugin) and Cloudflare Workers (paired + remote) modes.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 88.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 175 file(s), 2.88 MB of source, external domains: api.figma.com, docs.figma-console-mcp.southleft.com, example.com, figma-console-mcp.southleft.com, figma.com, fonts.googleapis.com, fonts.gstatic.com, github.com, p198.p4.n0.cdn.zight.com, southleft.com, www.figma.com, www.npmjs.com, www.w3.org

Source & flagged code

3 flagged

figma-desktop-bridge/code.jsView file

Lines 369-409javascript

369 // Use eval with async IIFE wrapper instead of AsyncFunction constructor

370 // AsyncFunction is restricted in Figma's plugin sandbox, but eval works

371 // See: https://developers.figma.com/docs/plugins/resource-links

372

373 // Wrap user code in an async IIFE that returns a Promise

374 // This allows async/await in user code while using eval

375 var wrappedCode = "(async function() {\n" + msg.code + "\n})()";

376

377 console.log('🌉 [Desktop Bridge] Wrapped code for eval');

378

379 // Execute with timeout

380 var timeoutMs = msg.timeout || 5000;

381 var timeoutPromise = new Promise(function(_, reject) {

382 setTimeout(function() {

383 reject(new Error('Execution timed out after ' + timeoutMs + 'ms'));

384 }, timeoutMs);

385 });

386

387 var codePromise;

388 try {

389 // eval returns the Promise from the async IIFE

390 codePromise = eval(wrappedCode);

391 } catch (syntaxError) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

figma-desktop-bridge/code.jsView on unpkg · L389

392 // Log the actual syntax error message

393 var syntaxErrorMsg = syntaxError && syntaxError.message ? syntaxError.message : String(syntaxError);

394 console.error('🌉 [Desktop Bridge] Syntax error in code:', syntaxErrorMsg);

395 figma.ui.postMessage({

396 type: 'EXECUTE_CODE_RESULT',

397 requestId: msg.requestId,

398 success: false,

399 error: 'Syntax error: ' + syntaxErrorMsg

400 });

401 return;

402 }

403

404 var result = await Promise.race([

405 codePromise,

406 timeoutPromise

407 ]);

408

409 console.log('🌉 [Desktop Bridge] Code executed successfully, result type:', typeof result);

dist/core/port-discovery.jsView file

Lines 177-217javascript

177 */

178function sleepSyncMs(ms) {

179 if (ms <= 0)

180 return;

181 try {

182

dist/cloudflare/core/port-discovery.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = figma-console-mcp@1.32.1 matchedPath = dist/apps/design-system-dashboard/scoring/accessibility.js matchedIdentity = npm:ZmlnbWEtY29uc29sZS1tY3A:1.32.1 similarity = 0.938 shingleOverlap = 75 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

dist/cloudflare/core/port-discovery.jsView on unpkg

Source & flagged code

3 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code