chron-mcp@0.1.43: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

chron-mcp@0.1.43: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery { Rich runtime records forwarded to the sender in dist/index.js: logQuery(query, params) { logQuery() { this.logger.logQuery(this.query.sql, params); logger.logQuery(query.sql, params); logger.logQuery(query.sql, params); this.logger.logQuery(this.query.sql, params); req.body = parse3(str); req.body = req.body || {};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

569* ### Useful links L570: * https://www.postgresql.org/docs/current/sql-createindex.html L571: * ... L777: } finally { L778: span.end(); L779: } ... L1644: } L1645: var textDecoder; L1646: var init_utils = __esm({ ... L2574: cache: { L2575: values: ["shared", "private"], L2576: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L569

20374patternName = generic_password severity = medium line = 20374 matchedText = password...al",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/index.jsView on unpkg · L20374

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = chron-mcp@0.1.31 matchedIdentity = npm:Y2hyb24tbWNw:0.1.31 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

6914"use strict"; L6915: var childProcess = require("child_process"); L6916: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6914

40244try { L40245: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40246: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40244

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Source & flagged code

8 flagged

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery { Rich runtime records forwarded to the sender in dist/index.js: logQuery(query, params) { logQuery() { this.logger.logQuery(this.query.sql, params); logger.logQuery(query.sql, params); logger.logQuery(query.sql, params); this.logger.logQuery(this.query.sql, params); req.body = parse3(str); req.body = req.body || {};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

569* ### Useful links L570: * https://www.postgresql.org/docs/current/sql-createindex.html L571: * ... L777: } finally { L778: span.end(); L779: } ... L1644: } L1645: var textDecoder; L1646: var init_utils = __esm({ ... L2574: cache: { L2575: values: ["shared", "private"], L2576: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L569

20374patternName = generic_password severity = medium line = 20374 matchedText = password...al",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/index.jsView on unpkg · L20374

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = chron-mcp@0.1.31 matchedIdentity = npm:Y2hyb24tbWNw:0.1.31 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

6914"use strict"; L6915: var childProcess = require("child_process"); L6916: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6914

40244try { L40245: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40246: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40244

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require