registry / @papi-ai/server / 0.7.49
@papi-ai/server@0.7.49
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
1187patternName = supabase_service_key
severity = critical
line = 1187
matchedText = MD_PINGS...JY";
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/index.jsView on unpkg · L11871187patternName = supabase_service_key
severity = critical
line = 1187
matchedText = MD_PINGS...JY";
Critical
77});
L78: import { execFileSync, spawnSync } from "child_process";
L79: function isGitAvailable() {
...
L331: }
L332: const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
L333: if (result.status !== 0) {
...
L390: if (sshMatch) {
L391: return `https://${sshMatch[1]}/${sshMatch[2]}`;
L392: }
...
L1046: const raw = readFileSync(INSTALL_ID_FILE, "utf-8");
L1047: const parsed = JSON.parse(raw);
L1048: if (isValidUuid(parsed.install_id)) {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L77Findings
2 Critical3 High5 Medium5 Low
CriticalCritical Secretdist/index.js
CriticalSecret Patterndist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @papi-ai/server@0.7.49.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.