registry / @webeetle/bigbrother-mcp / 1.1.1

@webeetle/bigbrother-mcp@1.1.1

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 17.2 KB of source, external domains: api.bitbucket.org, bitbucket.org, odeyjoufbijvimafapau.supabase.co

Source & flagged code

5 flagged

build/index.jsView file

14patternName = supabase_service_key severity = critical line = 14 matchedText = const SU...S4";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

build/index.jsView on unpkg · L14

14patternName = supabase_service_key severity = critical line = 14 matchedText = const SU...S4";

Critical

Secret Pattern

Supabase service role key (JWT) in build/index.js

build/index.jsView on unpkg · L14

5import { createClient } from "@supabase/supabase-js"; L6: import { exec as execCallback } from "node:child_process"; L7: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

build/index.jsView on unpkg · L5

5import { createClient } from "@supabase/supabase-js"; L6: import { exec as execCallback } from "node:child_process"; L7: import { promisify } from "node:util"; ... L12: // tramite Row Level Security (RLS). Non è un segreto. L13: const SUPABASE_URL = "https://odeyjoufbijvimafapau.supabase.co"; L14: const SUPABASE_ANON_KEY = "[redacted].[redacted]... ... L16: // ─── Configurazione Bitbucket ─────────────────────────────────────────────── L17: const BITBUCKET_WORKSPACE = process.env.BITBUCKET_WORKSPACE || "webucaneer"; L18: const BITBUCKET_REPO_SLUG = process.env.BITBUCKET_REPO_SLUG || "automatic-e2e-tests";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

build/index.jsView on unpkg · L5

287const specPath = spec.includes("/") || spec.includes("\\") ? spec : `**/*${spec}*.cy.js`; L288: const cmd = `npx cypress run --spec "${specPath}" ${isHeadless ? "--headless" : "--headed"}`; L289: const projectPath = "c:\\Users\\Ciro Tartaglia\\ProgettoAutomation"; L290: const { stdout } = await exec(cmd, { cwd: projectPath, maxBuffer: 10485760 }); L291: return { content: [{ type: "text", text: `Test completato.\n\nOutput:\n${stdout}` }] };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

build/index.jsView on unpkg · L287

Source & flagged code

5 flagged · loading source

build/index.jsView file

14patternName = supabase_service_key severity = critical line = 14 matchedText = const SU...S4";

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code