registry / @noclaf/mcp / 0.3.4

@noclaf/mcp@0.3.4

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

MCP server e CLI pra controlar o NOS (Noclaf Operation System) a partir de assistentes de IA como Claude Code, Codex CLI e GitHub Copilot.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 43 file(s), 179 KB of source, external domains: claude.ai, code.claude.com, code.visualstudio.com, developers.openai.com, github.com, nos.noclaf.com.br, registry.npmjs.org, wdshvtlsjoegjvmpqobx.supabase.co

Source & flagged code

3 flagged

dist/constants.jsView file

Lines 1-10javascript

1import { homedir } from 'node:os';

2import { join } from 'node:path';

3export const SUPABASE_URL = 'https://wdshvtlsjoegjvmpqobx.supabase.co';

4export const SUPABASE_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Indkc2h2dGxzam9lZ2p2bXBxb2J4Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzU3NDA4OTQsImV4cCI6MjA5MTMxNjg5NH0.4wlAsT_D5gDiBQ19WA-q5zu105fT9TsD1NKI_tGQt-4';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/constants.jsView on unpkg · L4

Critical

Secret Pattern

Supabase service role key (JWT) in dist/constants.js

dist/constants.jsView on unpkg · L4

5export const TOKEN_EXCHANGE_URL = `${SUPABASE_URL}/functions/v1/mcp-token-exchange`;

6export const CREDENTIALS_DIR = join(homedir(), '.noclaf');

7export const CREDENTIALS_FILE = join(CREDENTIALS_DIR, 'credentials.json');

8export const PROJECT_CONFIG_FILE = 'noclaf.json';

9export const PAT_REGEX = /^noc_[a-f0-9]{64}$/;

10//# sourceMappingURL=constants.js.map

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @noclaf/mcp@0.3.3 matchedIdentity = npm:QG5vY2xhZi9tY3A:0.3.3 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/constants.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code