Loading npm security reports…

@productbrain/mcp@0.0.1-beta.2326: Suspicious npm security report | LPM Firewall

registry / @productbrain/mcp / 0.0.1-beta.2326

@productbrain/mcp@0.0.1-beta.2326

Product Brain — MCP server for AI-assisted product knowledge management

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 6 file(s), 800 KB of source, external domains: claude.ai, eu.i.posthog.com, fonts.googleapis.com, fonts.gstatic.com, gateway.productbrain.io, productbrain.io, work.productbrain.io

Source & flagged code

4 flagged

dist/setup-Z5W4CQGG.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import {

3 DEFAULT_CLOUD_URL,

4 MCP_NPX_PACKAGE,

5 initAnalytics,

6 resolveClient,

7 shutdownAnalytics,

8 trackSetupCompleted,

9 trackSetupStarted,

10 warnOnProdFallthrough,

11 writeClientConfig

12} from "./chunk-DIMIOMXU.js";

14// src/cli/setup.ts

15import { execSync } from "child_process";

16import { createInterface } from "readline";

High

Child Process

Package source references child process execution.

dist/setup-Z5W4CQGG.jsView on unpkg · L14

17import { existsSync, writeFileSync, mkdirSync } from "fs";

18import { join } from "path";

19var APP_URL = process.env.PRODUCTBRAIN_APP_URL ?? "https://work.productbrain.io";

20function bold(s) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/setup-Z5W4CQGG.jsView on unpkg · L14

21 return `\x1B[1m${s}\x1B[0m`;

22}

23function green(s) {

24 return `\x1B[32m${s}\x1B[0m`;

25}

26function dim(s) {

27 return `\x1B[2m${s}\x1B[0m`;

28}

29function orange(s) {

30 return `\x1B[33m${s}\x1B[0m`;

31}

32function log(msg) {

33 process.stdout.write(`${msg}

34`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/setup-Z5W4CQGG.jsView on unpkg · L14

dist/chunk-ZKKCE6RK.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @productbrain/mcp@0.0.1-beta.2312 matchedIdentity = npm:QHByb2R1Y3RicmFpbi9tY3A:0.0.1-beta.2312 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-ZKKCE6RK.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/setup-Z5W4CQGG.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code