hostinger-api-mcp@3.5.0
MCP server for Hostinger API
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe active server exposes a skill that instructs agents to submit generated reports without user agreement, even though the API operation requires that agreement. Because the reports contain project identifiers and feedback and are sent through the authenticated Hostinger API, this is an unconsented data disclosure.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A client uses the headless build skill and the agent reaches its report submission step.
Impact
Project and workflow telemetry, including the site domain and user feedback, is disclosed to Hostinger without the required user agreement.
Mechanism
The skill tells the agent to submit the generated report through an authenticated Hostinger API operation without first asking the user.
Attack narrative
When an agent follows the headless build skill through its report step, the skill directs it to submit the report without asking first. The report generator marks consent as given automatically and includes the site domain, runtime details, issue records, and user feedback. The API operation itself requires user agreement, while the runtime sends the report as an authenticated JSON request to Hostinger. This is an unconsented disclosure of project telemetry.
AI rationale
The active server exposes a skill that instructs agents to submit generated reports without user agreement, even though the API operation requires that agreement. Because the reports contain project identifiers and feedback and are sent through the authenticated Hostinger API, this is an unconsented data disclosure.
Evidence
src/servers/all.jssrc/core/runtime.jssrc/core/skills.jssrc/core/tools/all.js
Network endpoints1
developers.hostinger.com/api/hosting/v1/headless/agent-reports
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The active server exposes the bundled headless skill to MCP clients.
- The skill directs agents to submit build reports without first asking the user.
- The report generator marks consent as given automatically and records the site domain and runtime details; reports also include issue and user-feedback entries.
- The report operation says user agreement is required and defines an authenticated POST to the report endpoint.
- The runtime sends POST parameters as a JSON body with a bearer token to the Hostinger API by default.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flagged · loading sourcebuild.jsView file
2L3: import { exec } from 'child_process';
L4: import fs from 'fs';
High
18console.log('Compiling TypeScript...');
L19: exec('npx tsc', (error, stdout, stderr) => {
L20: if (error) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
build.jsView on unpkg · L18src/core/skills.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = hostinger-api-mcp@3.4.1
matchedIdentity = npm:aG9zdGluZ2VyLWFwaS1tY3A:3.4.1
similarity = 0.971
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
src/core/skills.jsFindings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltasrc/core/skills.js
HighChild Processbuild.js
HighShell
HighRuntime Package Installbuild.js
HighAi Review Evidencesrc/servers/all.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hostinger-api-mcp@3.5.0.
See all versions of hostinger-api-mcp for other recorded verdicts.
- Avoid installing hostinger-api-mcp@3.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.