@sandovalrr/project-context-mcp: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@sandovalrr/project-context-mcp: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/project-context-mcp.jsView file

37536// src/core/repository.ts L37537: import { spawnSync } from "node:child_process"; L37538: import { realpath } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/project-context-mcp.jsView on unpkg · L37536

2893sourceCode = this.opts.code.process(sourceCode, sch); L2894: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2895: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/project-context-mcp.jsView on unpkg · L2893

dist/project-context.jsView file

1255Cross-file remote execution chain: dist/project-context.js spawns dist/project-context-mcp.js; helper contains network access plus dynamic code execution. L1255: var names = { L1256: data: new codegen_1.Name("data"), L1257: valCxt: new codegen_1.Name("valCxt"), ... L2242: id = normalizeId(id); L2243: return resolver.resolve(baseId, id); L2244: } ... L3090: for (i = 0;i < input.length; i++) { L3091: code = input[i].charCodeAt(0); L3092: if (code === 48) { ... L11750: *next(token) { L11751: if (node_process.env.LOG_STREAM) L11752: console.dir(token, { depth: null });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/project-context.jsView on unpkg · L1255

46}; L47: var __require = /* @__PURE__ */ createRequire(import.meta.url); L48:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/project-context.jsView on unpkg · L46

1255var names = { L1256: data: new codegen_1.Name("data"), L1257: valCxt: new codegen_1.Name("valCxt"), ... L2242: id = normalizeId(id); L2243: return resolver.resolve(baseId, id); L2244: } ... L3090: for (i = 0;i < input.length; i++) { L3091: code = input[i].charCodeAt(0); L3092: if (code === 48) { ... L11750: *next(token) { L11751: if (node_process.env.LOG_STREAM) L11752: console.dir(token, { depth: null });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/project-context.jsView on unpkg · L1255

Source & flagged code

5 flagged

dist/project-context-mcp.jsView file

37536// src/core/repository.ts L37537: import { spawnSync } from "node:child_process"; L37538: import { realpath } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/project-context-mcp.jsView on unpkg · L37536

2893sourceCode = this.opts.code.process(sourceCode, sch); L2894: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2895: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/project-context-mcp.jsView on unpkg · L2893

dist/project-context.jsView file

1255Cross-file remote execution chain: dist/project-context.js spawns dist/project-context-mcp.js; helper contains network access plus dynamic code execution. L1255: var names = { L1256: data: new codegen_1.Name("data"), L1257: valCxt: new codegen_1.Name("valCxt"), ... L2242: id = normalizeId(id); L2243: return resolver.resolve(baseId, id); L2244: } ... L3090: for (i = 0;i < input.length; i++) { L3091: code = input[i].charCodeAt(0); L3092: if (code === 48) { ... L11750: *next(token) { L11751: if (node_process.env.LOG_STREAM) L11752: console.dir(token, { depth: null });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/project-context.jsView on unpkg · L1255

46}; L47: var __require = /* @__PURE__ */ createRequire(import.meta.url); L48:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/project-context.jsView on unpkg · L46

1255var names = { L1256: data: new codegen_1.Name("data"), L1257: valCxt: new codegen_1.Name("valCxt"), ... L2242: id = normalizeId(id); L2243: return resolver.resolve(baseId, id); L2244: } ... L3090: for (i = 0;i < input.length; i++) { L3091: code = input[i].charCodeAt(0); L3092: if (code === 48) { ... L11750: *next(token) { L11751: if (node_process.env.LOG_STREAM) L11752: console.dir(token, { depth: null });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/project-context.jsView on unpkg · L1255