registry / @szc-ft/mcp-szcd-client / 0.40.0

@szc-ft/mcp-szcd-client@0.40.0

⚠ Under review

MCP client for szcd component library - auto-configures AI coding tools with MCP server, skills, agents and commands

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 22 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 239 file(s), 2.38 MB of source, external domains: a.com, api.example.com, cdn.jsdelivr.net, default.com, e-kjr1wok.coding.smartcitysz.work, example.com, github.com, httpbin.org, mcp.szcd-mcp.top, npmmirror.com, opencode.ai, platform.aicityos.com, registry.npmmirror.com, stg.com, stg.example.com, test.example.com, www.apple.com, www.google.com, x.com, yapi.smartcitysz.work

Source & flagged code

14 flagged

package.jsonView file

Lines 34-73json

34 "lib/",

35 "scripts/postinstall.js",

36 "scripts/install-dev-shortcuts.js",

37 "scripts/update-mcp-url.js",

38 "scripts/update-coding-config.js",

39 "scripts/update-api-config.js",

40 "scripts/update-auth.js",

41 "scripts/lib/",

42 "standard-skill/",

43 "agents/",

44 "commands/",

45 "qwen-extension/",

46 "opencode-extension/",

47 "AGENTS.md",

48 "README.md"

49 ],

50 "engines": {

51 "node": ">=18"

52 },

53 "scripts": {

54 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "setup": "node scripts/postinstall.js",

56 "setup:quick": "node scripts/postinstall.js --quick",

57 "build:agents": "node agents/build.js",

58 "prepublishOnly": "node agents/build.js"

59 },

60 "dependencies": {

61 "@modelcontextprotocol/sdk": "^1.29.0",

62 "yaml": "^2.9.0"

63 },

64 "repository": {

65 "type": "git",

66 "url": "git+https://github.com/szc-ft/mcp-szcd.git"

67 },

68 "bugs": {

69 "url": "https://github.com/szc-ft/mcp-szcd/issues"

70 },

71 "homepage": "https://github.com/szc-ft/mcp-szcd#readme"

72}

qwen-extension/skills/local-browser-test/tests/integration/pr-03.test.jsView file

Lines 269-309javascript

269 } finally { tmp.cleanup(); }

270 });

271

272 it('archiveFailedRun 把失败 run 移入 runs-failed/', () => {

273 const tmp =

qwen-extension/skills/local-browser-test/lib/cdp-browser-config.jsView file

Lines 11-51javascript

11 * @returns {{ userDataDir: string, remoteDebuggingPort: string, args: string[] }}

12 */

13export function getBrowserConfigFromProcess(browserName = 'msedge') {

qwen-extension/skills/local-browser-test/scripts/verify-picker-skeleton.mjsView file

Lines 1-37javascript

1// ★ 骨架验证：lib/picker/fiber-locate.js 模块化后注入页面，重验 L1/L2/L3 关联

2import { createRequire } from 'node:module';

3import { readFileSync } from 'node:fs';

4const require = createRequire(

qwen-extension/skills/local-browser-test/tests/unit/raw-script-helpers.test.jsView file

Lines 31-71javascript

32 it('fn 形态：async 箭头函数整体', () => {

33 assert.equal(classifyRawScript('async (page, frame, params, browser) => { return { passed: true } }').kind, 'fn');

34 });

scripts/postinstall.jsView file

Lines 5-45javascript

5 *

6 * 支持两种模式：

7 * --quick 快速模式（默认）：仅显示提示，不执行耗时操作

8 * 默认完整模式：执行所有 IDE 配置

9 *

10 * 具体逻辑按 IDE 兼容方向抽离到 scripts

qwen-extension/skills/local-browser-test/lib/shared-deps.jsView file

Lines 67-107javascript

67 const { execSync } = await import("node:child_process");

68 const pkgList = missing.join(" ");

qwen-extension/skills/local-api-tool/scripts/extract_swagger.pyView file

•path = qwen-extension/skills/local-api-tool/scripts/extract_swagger.py kind = build_helper sizeBytes = 23931 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

qwen-extension/skills/local-api-tool/scripts/extract_swagger.pyView on unpkg

scripts/update-mcp-url.jsView file

•matchType = token_shingles matchedPackage = @szc-ft/mcp-szcd-client@0.38.0 matchedPath = scripts/update-mcp-url.js matchedIdentity = npm:QHN6Yy1mdC9tY3Atc3pjZC1jbGllbnQ:0.38.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High