brokre@0.2.26
⚠ Under reviewMCP launcher for brokre — local credential broker for Cursor, Claude Code, Kimi Code, Trae, OpenClaw, Hermes Agent, ChatClaw, and other MCP clients
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 0.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node setup-mcp.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
9L10: const { spawn, execFileSync } = require('child_process');
L11: const fs = require('fs');
L12: const http = require('http');
L13: const https = require('https');
...
L17:
L18: const { version: PKG_VERSION } = require('./package.json');
L19: const REPO = 'Furowu/brokre';
...
L45: */
L46: function isLauncherScript(binPath, platform = process.platform) {
L47: if (!binPath) return false;
...
L69: });
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
index.jsView on unpkg · L99Trigger-reachable persistence chain: manifest.main -> index.js
L9:
L10: const { spawn, execFileSync } = require('child_process');
L11: const fs = require('fs');
L12: const http = require('http');
L13: const https = require('https');
...
L17:
L18: const { version: PKG_VERSION } = require('./package.json');
L19: const REPO = 'Furowu/brokre';
...
L45: */
L46: function isLauncherScript(binPath, platform = process.platform) {
L47: if (!binPath) return false;
...
L69: });
Findings
1 Critical3 High4 Medium4 Low
CriticalAi Agent Control Hijacksetup-mcp.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityindex.js
HighTrigger Reachable Persistenceindex.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceindex.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to brokre@0.2.26.
See all versions of brokre for other recorded verdicts.
- Review the evidence and your use of brokre@0.2.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.