integram-mcp@0.7.11: Suspicious npm security report (Warn)

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 129 KB of source, external domains: api.example.com, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

index.jsView file

2018L2019: import { execSync } from 'child_process'; L2020: import { dirname } from 'path';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2018

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. index.js: const NPM_REGISTRY = (process.env.npm[redacted] || 'https://registry.npmjs.org').replace(/\/$/, ''); const { readFileSync, writeFileSync } = await import('fs'); try { writeFileSync(cacheFile, JSON.stringify({ checkedAt: Date.now(), latest })); } catch { /* кэш необязателен */ } log(`Доступна версия ${latest} (запущена ${PKG.version}): https://www.npmjs.com/package/${PKG.name}`); `Список изменений: https://www.npmjs.com/package/${PKG.name}`, - \`const r = await fetch('https://api.example.com?q=' + encodeURIComponent(row['Name'])); const d = await r.json(); output(d.price)\` — fetch from external API

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

index.jsView on unpkg

2033log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L2034: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L2035: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L2033

Source & flagged code

3 flagged · loading source

index.jsView file

2018L2019: import { execSync } from 'child_process'; L2020: import { dirname } from 'path';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2018

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. index.js: const NPM_REGISTRY = (process.env.npm[redacted] || 'https://registry.npmjs.org').replace(/\/$/, ''); const { readFileSync, writeFileSync } = await import('fs'); try { writeFileSync(cacheFile, JSON.stringify({ checkedAt: Date.now(), latest })); } catch { /* кэш необязателен */ } log(`Доступна версия ${latest} (запущена ${PKG.version}): https://www.npmjs.com/package/${PKG.name}`); `Список изменений: https://www.npmjs.com/package/${PKG.name}`, - \`const r = await fetch('https://api.example.com?q=' + encodeURIComponent(row['Name'])); const d = await r.json(); output(d.price)\` — fetch from external API

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

index.jsView on unpkg

2033log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L2034: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L2035: // Allow pending responses to drain before exit

Findings

4 High3 Medium5 Low

HighChild Processindex.js

HighShell

HighEntrypoint Foreign Package Code Overwriteindex.js

HighRuntime Package Installindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code