registry  /  @productbrain/mcp  /  0.0.1-beta.2057

@productbrain/mcp@0.0.1-beta.2057

⚠ Under review

Product Brain — MCP server for AI-assisted product knowledge management

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsTelemetryUrlStrings
Manifest
NoLicense
scanned 6 file(s), 747 KB of source, external domains: claude.ai, eu.i.posthog.com, fonts.googleapis.com, fonts.gstatic.com, gateway.productbrain.io, productbrain.io, work.productbrain.io

Source & flagged code

2 flagged · loading source
dist/chunk-XIERWSPE.jsView file
12101contains invisible/control Unicode U+200B (zero width space) var NON_MEANINGFUL_TASK_RE = /^[\s<U+200B><U+200C><U+200D><U+2060><U+FEFF>]*$/u;
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-XIERWSPE.jsView on unpkg · L12101
•Trigger-reachable chain: manifest.bin -> dist/index.js -> dist/chunk-XIERWSPE.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-XIERWSPE.jsView on unpkg

Findings

2 Critical3 Medium7 Low
CriticalTrojan Source Unicodedist/chunk-XIERWSPE.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-XIERWSPE.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License