chron-mcp@0.1.44: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

chron-mcp@0.1.44: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery { Rich runtime records forwarded to the sender in dist/index.js: logQuery(query, params) { logQuery() { this.logger.logQuery(this.query.sql, params); logger.logQuery(query.sql, params); logger.logQuery(query.sql, params); this.logger.logQuery(this.query.sql, params); req.body = parse3(str); req.body = req.body || {};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

568* ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L568

20281patternName = generic_password severity = medium line = 20281 matchedText = password...al",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/index.jsView on unpkg · L20281

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40198try { L40199: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40200: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40198

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

751error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L752: } : { success: true, data: result.value }; L753: }; ... L790: } L791: var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid, email, _emoji, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource, date, string, integer, nu... L792: var init_regexes = __esm({ ... L1726: try { L1727: new URL(`http://[${payload.value}]`); L1728: } catch { ... L6662: cache: { L6663: values: ["shared", "private"], L6664: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

Source & flagged code

7 flagged

dist/cli/index.jsView file

•Default external logging endpoint and rich-record POST in dist/cli/index.js: // node_modules/drizzle-orm/subquery.js var Subquery, WithSubquery; var init_subquery = __esm({ "node_modules/drizzle-orm/subquery.js"() { Subquery = class { static [entityKind] = "Subquery"; brand: "Subquery", WithSubquery = class extends Subquery { Rich runtime records forwarded to the sender in dist/index.js: logQuery(query, params) { logQuery() { this.logger.logQuery(this.query.sql, params); logger.logQuery(query.sql, params); logger.logQuery(query.sql, params); this.logger.logQuery(this.query.sql, params); req.body = parse3(str); req.body = req.body || {};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli/index.jsView on unpkg

568* ### Useful links L569: * https://www.postgresql.org/docs/current/sql-createindex.html L570: * ... L775: } finally { L776: span.end(); L777: } ... L1631: } L1632: var textDecoder; L1633: var init_utils = __esm({ ... L2561: cache: { L2562: values: ["shared", "private"], L2563: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L568

20281patternName = generic_password severity = medium line = 20281 matchedText = password...al",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/index.jsView on unpkg · L20281

dist/index.jsView file

6913"use strict"; L6914: var childProcess = require("child_process"); L6915: var { isLinux, getReport } = require_process();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6913

40198try { L40199: (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" }); L40200: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L40198

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

751error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L752: } : { success: true, data: result.value }; L753: }; ... L790: } L791: var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid, email, _emoji, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource, date, string, integer, nu... L792: var init_regexes = __esm({ ... L1726: try { L1727: new URL(`http://[${payload.value}]`); L1728: } catch { ... L6662: cache: { L6663: values: ["shared", "private"], L6664: update: (key, value) => connectionQueryParams.push(`${key}=${value}`)