registry / @noclaf/mcp / 0.3.2

@noclaf/mcp@0.3.2

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

MCP server e CLI pra controlar o NOS (Noclaf Operation System) a partir de assistentes de IA como Claude Code, Codex CLI e GitHub Copilot.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 41 file(s), 167 KB of source, external domains: github.com, nos.noclaf.com.br, wdshvtlsjoegjvmpqobx.supabase.co

Source & flagged code

2 flagged

dist/constants.jsView file

Lines 1-10javascript

1import { homedir } from 'node:os';

2import { join } from 'node:path';

3export const SUPABASE_URL = 'https://wdshvtlsjoegjvmpqobx.supabase.co';

4export const SUPABASE_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Indkc2h2dGxzam9lZ2p2bXBxb2J4Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzU3NDA4OTQsImV4cCI6MjA5MTMxNjg5NH0.4wlAsT_D5gDiBQ19WA-q5zu105fT9TsD1NKI_tGQt-4';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/constants.jsView on unpkg · L4

Critical

Secret Pattern

Supabase service role key (JWT) in dist/constants.js

dist/constants.jsView on unpkg · L4

5export const TOKEN_EXCHANGE_URL = `${SUPABASE_URL}/functions/v1/mcp-token-exchange`;

6export const CREDENTIALS_DIR = join(homedir(), '.noclaf');

7export const CREDENTIALS_FILE = join(CREDENTIALS_DIR, 'credentials.json');

8export const PROJECT_CONFIG_FILE = 'noclaf.json';

9export const PAT_REGEX = /^noc_[a-f0-9]{64}$/;

10//# sourceMappingURL=constants.js.map

Source & flagged code

2 flagged · loading source

dist/constants.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code