registry / @samanhappy/mcphub / 1.0.24

@samanhappy/mcphub@1.0.24

A hub server for mcp servers

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 218 file(s), 2.26 MB of source, external domains: admin.example.com, api.example.com, api.mcprouter.to, api.openai.com, api.siliconflow.cn, app.example.com, discord.gg, docs.mcphub.app, example.com, github.com, hf-mirror.com, huggingface.co, issuer.example.com, ko-fi.com, mcphub.local, mcpm.sh, mcprouter.co, openrouter.ai, petstore.swagger.io, pypi.org, react.dev, registry.modelcontextprotocol.io, registry.npmjs.org, www.mcphub.app, www.w3.org

Source & flagged code

5 flagged

frontend/dist/assets/index-xwxOTCc_.jsView file

Lines 1-4javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./LoginPage-Chm4p59K.js","./framework-vendor-X-WP1v0m.js","./i18n-vendor-BLr2MLKp.js","./icons-vendor-DMtsx1SI.js","./Dashboard-XMPV4Ypu.js","./contextCost-KhOeuF-d.js","./useSettingsData-DegWU8bg.js","./EndpointCopy-Ch7HbIsp.js","./StatusDot-BF-uWsCA.js","./ServersPage-Dq_yBsZM.js","./ToggleGroup-DMC5NEP5.js","./toolDescription-Dw3sa28K.js","./DeleteDialog-7NPk3Hro.js","./ConfirmDialog-BKNVI65J.js","./variableDetection-D6KIhNDI.js","./Pagination-DAcOi8eq.js","./GroupsPage-DkUg6Xih.js","./UsersPage-BA9TJs2F.js","./SettingsPage-DoHjlHsl. ...

2var wt=Object.defineProperty;var xt=(e,r,t)=>r in e?wt(e,r,{enumerable:!0,configurable:!0,writable:!0,value:t}):e[r]=t;var Ae=(e,r,t)=>xt(e,typeof r!="symbol"?r+""

3//# sourceMappingURL=index-xwxOTCc_.js.map

Long lines were clipped for display.

bin/cli.jsView file

Lines 65-105javascript

65 }

66 }

67 }

69 if (!isCliCommand) {

70 console.log('⚠️ Could not find package.json, using default path');

71 }

72 return path.resolve(__dirname, '..');

73}

dist/models/User.jsView file

Lines 68-126javascript

68 const userDao = getUserDao();

69 const user = await userDao.findBySsoUserId(ssoUserId);

70 return user || undefined;

71 }

72 catch (error) {

dist/scripts/dao-demo.jsView file

Lines 117-157javascript

117 console.log(`DAO layer data:

118- Users: ${daoSettings.users?.length || 0}

119- Servers: ${Object.keys(daoSettings.mcpServers || {}).length}

120- Groups: ${daoSettings.groups?.

Source & flagged code

5 flagged · loading source

frontend/dist/assets/index-xwxOTCc_.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = var wt=O... x};

Medium

Secret Pattern

Package contains a possible secret pattern.

frontend/dist/assets/index-xwxOTCc_.jsView on unpkg · L2

bin/cli.jsView file

85const cliEntryUrl = pathToFileURL(cliEntryPath).href; L86: const mod = await import(cliEntryUrl); L87: await mod.runCli(argv);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L85

dist/models/User.jsView file

88patternName = generic_password severity = medium line = 88 matchedText = console....or);

Medium

Secret Pattern

Hardcoded password in dist/models/User.js

dist/models/User.jsView on unpkg · L88

121patternName = generic_password severity = medium line = 121 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in dist/models/User.js

dist/models/User.jsView on unpkg · L121

dist/scripts/dao-demo.jsView file

137patternName = generic_password severity = medium line = 137 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/scripts/dao-demo.js

dist/scripts/dao-demo.jsView on unpkg · L137

Findings

8 Medium4 Low

MediumSecret Patternfrontend/dist/assets/index-xwxOTCc_.js

MediumDynamic Requirebin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/models/User.js

MediumSecret Patterndist/scripts/dao-demo.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

frontend/dist/assets/index-xwxOTCc_.jsView file

Lines 1-4javascript

2var wt=Object.defineProperty;var xt=(e,r,t)=>r in e?wt(e,r,{enumerable:!0,configurable:!0,writable:!0,value:t}):e[r]=t;var Ae=(e,r,t)=>xt(e,typeof r!="symbol"?r+""

3//# sourceMappingURL=index-xwxOTCc_.js.map

Long lines were clipped for display.

bin/cli.jsView file

Lines 65-105javascript

65 }

66 }

67 }

69 if (!isCliCommand) {

70 console.log('⚠️ Could not find package.json, using default path');

71 }

72 return path.resolve(__dirname, '..');

73}

dist/models/User.jsView file

Lines 68-126javascript

68 const userDao = getUserDao();

69 const user = await userDao.findBySsoUserId(ssoUserId);

70 return user || undefined;

71 }

72 catch (error) {

dist/scripts/dao-demo.jsView file

Lines 117-157javascript

117 console.log(`DAO layer data:

118- Users: ${daoSettings.users?.length || 0}

119- Servers: ${Object.keys(daoSettings.mcpServers || {}).length}

120- Groups: ${daoSettings.groups?.