registry / @papi-ai/server / 0.7.85
@papi-ai/server@0.7.85
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/backfill-cycle-metrics.jsView file
247});
L248: import { execFileSync, spawnSync } from "child_process";
L249: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L247dist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
const hostedSupabaseUrl = cleanUrl(env.hostedSupabaseUrl);
dataEndpoint: cleanUrl(env.dataEndpoint) ?? (hostedSupabaseUrl ? `${hostedSupabaseUrl}/functions/v1/data-proxy` : void 0) ?? (selfHosted ? void 0 : `${HOSTED_SUPABASE_URL}/function...
import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
hostedSupabaseUrl: process.env["PAPI_HOSTED_SUPABASE_URL"]
"Authorization": `Bearer ${apiKey}`
"Authorization": `Bearer ${this.apiKey}`
"Authorization": `Bearer ${this.apiKey}`
"Authorization": `Bearer ${this.apiKey}`
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkgFindings
5 High4 Medium5 Low
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighCredential Redirect Persistencedist/index.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighCommand Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @papi-ai/server@0.7.85.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.85 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.