registry / fractascan-mcp / 0.1.3

fractascan-mcp@0.1.3

Model Context Protocol server exposing Fracta scan tools (passive_scan, scan_repo, …)

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 8 file(s), 661 KB of source, external domains: api.anthropic.com, app.seu-dominio.com, cve.mitre.org, cwe.mitre.org, datatracker.ietf.org, docs.anthropic.com, docs.expo.dev, docs.nestjs.com, docs.stripe.com, evil.com, exemplo.com.br, fracta.pro, github.com, meuapp.com.br, owasp.org, platform.claude.com, supabase.com, www.gov.br, www.prisma.io

Source & flagged code

5 flagged

dist/index.jsView file

Lines 35-75javascript

35}

36function analyzeCsp(policy) {

37 const d = parse(policy);

38 const issues = [];

39 const scriptSrc = d.get("script-src") ?? d.get("default-src");

40 const styleSrc = d.get("style-src") ?? d.get("default-src");

41 const has = (dir) => d.has(dir);

42 if (scriptSrc?.includes("'unsafe-inline'") && !scriptSrc.some((v) => v.startsWith("'nonce-") || v.startsWith("'sha"))) {

43 issues.push({

44 rule: "csp-unsafe-inline-script",

45 severity: "high",

46 title: "CSP com 'unsafe-inline' em script-src",

47 detail: "'unsafe-inline' autoriza QUALQUER script inline \u2014 inclusive o injetado por XSS. Isso anula a principal prote\xE7\xE3o do CSP: o header existe, mas contra XSS n\xE3o vale quase nada.",

48 recommendation: "Remova 'unsafe-inline' de script-src e use nonce por request ou hash dos scripts inline (com 'strict-dynamic')."

49 });

50 }

51 if (scriptSrc?.includes("'unsafe-eval'")) {

52 issues.push({

53 rule: "csp-unsafe-eval",

54 severity: "medium",

55 title: "CSP com 'unsafe-eval' em script-src",

56 detail: "'unsafe-eval' reabre eval()/new Function()/setTimeout(string) \u2014 amplia a superf\xEDcie de XSS.",

57 recommendation: "Remova 'unsafe-eval' e refatore o c\xF3digo que depende de eval/Function din\xE2micos."

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L55

58 });

59 }

60 if (!has("script-src") && !has("default-src")) {

61 issues.push({

62 rule: "csp-no-script-src",

63 severity: "medium",

64 title: "CSP sem script-src nem default-src",

65 detail: "Sem script-src (nem default-src como fallback), a origem dos scripts n\xE3o \xE9 restringida pela policy.",

66 recommendation: "Defina script-src 'self' (+ nonce/hash p/ inline) ou ao menos um default-src 'self'."

67 });

68 }

69 if (scriptSrc && (scriptSrc.includes("*") || scriptSrc.includes("https:") || scriptSrc.includes("http:"))) {

70 issues.push({

71 rule: "csp-broad-script-src",

72 severity: "medium",

73 title: "CSP com script-src muito amplo (* / https:)",

74 detail: "Permitir '*', 'https:' ou 'http:' em script-src deixa carregar script de quase qualquer origem \u2014 enfraquece muito a prote\xE7\xE3o.",

75 recommendation: "Liste apenas as origens confi\xE1veis; prefira nonce/hash + strict-dynamic a curingas."

Lines 1176-1216javascript

1176 }

1177 }

1178 async testRateLimit(scope, findings) {

1179 const authEndpoint = scope.target.auth?.endpoint;

1180 if (!authEndpoint) {

1181 findings.push({

1182 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

1183 runId: scope.runId,

Lines 1915-1955javascript

1915 endpoint: path,

1916 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

1917 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu\xE1

Lines 3873-3913javascript

3873 category: this.category,

3874 camada: this.category,

3875 severity: "critical",

3876 title: `Prisma Studio exposto: ${path}`,

3877 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,

•matchType = previous_version_dangerous_delta matchedPackage = fractascan-mcp@0.1.1 matchedIdentity = npm:ZnJhY3Rhc2Nhbi1tY3A:0.1.1 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1196patternName = generic_password severity = medium line = 1196 matchedText = const bo..." };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L1196

1935patternName = generic_password severity = medium line = 1935 matchedText = body: { ..." },

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L1935

3893patternName = generic_password severity = medium line = 3893 matchedText = password...99",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3893

55title: "CSP com 'unsafe-eval' em script-src", L56: detail: "'unsafe-eval' reabre eval()/new Function()/setTimeout(string) \u2014 amplia a superf\xEDcie de XSS.", L57: recommendation: "Remova 'unsafe-eval' e refatore o c\xF3digo que depende de eval/Function din\xE2micos."

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L55

Findings

1 High6 Medium6 Low

HighPrevious Version Dangerous Deltadist/index.js

MediumSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

MediumSecret Patterndist/index.js

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/index.jsView file

Lines 35-75javascript

35}

36function analyzeCsp(policy) {

37 const d = parse(policy);

38 const issues = [];

39 const scriptSrc = d.get("script-src") ?? d.get("default-src");

40 const styleSrc = d.get("style-src") ?? d.get("default-src");

41 const has = (dir) => d.has(dir);

42 if (scriptSrc?.includes("'unsafe-inline'") && !scriptSrc.some((v) => v.startsWith("'nonce-") || v.startsWith("'sha"))) {

43 issues.push({

44 rule: "csp-unsafe-inline-script",

45 severity: "high",

46 title: "CSP com 'unsafe-inline' em script-src",

48 recommendation: "Remova 'unsafe-inline' de script-src e use nonce por request ou hash dos scripts inline (com 'strict-dynamic')."

49 });

50 }

51 if (scriptSrc?.includes("'unsafe-eval'")) {

52 issues.push({

53 rule: "csp-unsafe-eval",

54 severity: "medium",

55 title: "CSP com 'unsafe-eval' em script-src",

56 detail: "'unsafe-eval' reabre eval()/new Function()/setTimeout(string) \u2014 amplia a superf\xEDcie de XSS.",

57 recommendation: "Remova 'unsafe-eval' e refatore o c\xF3digo que depende de eval/Function din\xE2micos."

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L55

58 });

59 }

60 if (!has("script-src") && !has("default-src")) {

61 issues.push({

62 rule: "csp-no-script-src",

63 severity: "medium",

64 title: "CSP sem script-src nem default-src",

65 detail: "Sem script-src (nem default-src como fallback), a origem dos scripts n\xE3o \xE9 restringida pela policy.",

66 recommendation: "Defina script-src 'self' (+ nonce/hash p/ inline) ou ao menos um default-src 'self'."

67 });

68 }

69 if (scriptSrc && (scriptSrc.includes("*") || scriptSrc.includes("https:") || scriptSrc.includes("http:"))) {

70 issues.push({

71 rule: "csp-broad-script-src",

72 severity: "medium",

73 title: "CSP com script-src muito amplo (* / https:)",

74 detail: "Permitir '*', 'https:' ou 'http:' em script-src deixa carregar script de quase qualquer origem \u2014 enfraquece muito a prote\xE7\xE3o.",

75 recommendation: "Liste apenas as origens confi\xE1veis; prefira nonce/hash + strict-dynamic a curingas."

Lines 1176-1216javascript

1176 }

1177 }

1178 async testRateLimit(scope, findings) {

1179 const authEndpoint = scope.target.auth?.endpoint;

1180 if (!authEndpoint) {

1181 findings.push({

1182 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

1183 runId: scope.runId,

Lines 1915-1955javascript

1915 endpoint: path,

1916 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

1917 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu\xE1

Lines 3873-3913javascript

3873 category: this.category,

3874 camada: this.category,

3875 severity: "critical",

3876 title: `Prisma Studio exposto: ${path}`,

3877 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg