registry / mcp-scraper / 0.102.4
mcp-scraper@0.102.4
Authenticated public client for hosted MCP Scraper tools and REST APIs
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged CLI uses credentials for requests to the package’s own service, and its agent configuration write requires an explicit `--apply` command option. Although a memory sink capable of posting supplied arguments exists, no call site was found in the inspected CLI source, so the static warnings do not establish an attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
The CLI runs when a user invokes one of its commands. The inspected agent configuration change requires the explicit `--apply` option.
Impact
No unauthorized credential transfer, command execution, or default agent configuration change was established.
Mechanism
CLI requests use the configured MCP Scraper API URL and API key. Workflow downloads are written under the selected output directory. The memory sink posts to the configured base URL, but no call site was found in the inspected CLI source.
AI rationale
The flagged CLI uses credentials for requests to the package’s own service, and its agent configuration write requires an explicit `--apply` command option. Although a memory sink capable of posting supplied arguments exists, no call site was found in the inspected CLI source, so the static warnings do not establish an attack.
Evidence
<outputDir>/workflow-downloads/<run-id>/<artifact>
Network endpoints2
mcpscraper.devregistry.npmjs.org/mcp-scraper/latest
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest presents this as an authenticated client for the hosted MCP Scraper service and defines its library entry points and CLI commands.
- The CLI’s optional memory sink posts arguments to the package’s default service host and uses the MCP Scraper API key; I found no call site for that sink in the inspected CLI source.
- Agent configuration changes require the user to pass `--apply`; the inspected code restricts applying the change to Claude Code.
- The CLI downloads workflow artifacts from the configured API URL and writes them to its output directory, consistent with its stated workflow-download feature.
Evidence against
- The CLI contains a memory sink that can send supplied arguments and the API key to `/memory/mcp-call` on the configured base URL.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/bin/mcp-scraper-cli.jsView file
1#!/usr/bin/env node
L2: import{Command as Fe}from"commander";import{spawn as ye}from"node:child_process";import{mkdir as ze,writeFile as Ze}from"node:fs/promises";import{basename as Qe,join as ge}from"nod...
L3: command = "npx"
High
Child Process
Package source references child process execution.
dist/bin/mcp-scraper-cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import{Command as Fe}from"commander";import{spawn as ye}from"node:child_process";import{mkdir as ze,writeFile as Ze}from"node:fs/promises";import{basename as Qe,join as ge}from"nod...
L3: command = "npx"
...
L10: `):[`# ${n.label} MCP config`,l,n.exactConfig,"",`Continuation: ${n.continuation}`,`Rollback: ${n.rollback}`,...n.restartRequired?["",a]:[]].join(`
L11: `)}import{homedir as $e}from"node:os";import{join as Ee}from"node:path";function k(e){return e?.trim()||process.env.MCP_SCRAPER_OUTPUT_DIR?.trim()||Ee($e(),"Downloads","mcp-scraper...
L12: Fix: ${n.fix}`:"";return`[${r[n.status]}] ${n.label}: ${n.detail}${a}`}),"",`Recommended MCP command: npx ${e.recommendedConfig.args.join(" ")}`].join(`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin/mcp-scraper-cli.jsView on unpkg · L1Findings
9 High3 Medium2 Low
HighChild Processdist/bin/mcp-scraper-cli.js
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighCredential Exfiltrationdist/bin/mcp-scraper-cli.js
HighCommand Output Exfiltrationdist/bin/mcp-scraper-cli.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighTrigger Reachable Credential Exfiltrationdist/bin/mcp-scraper-cli.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/mcp-scraper-cli.js
HighKnown Malware Source Similaritydist/bin/mcp-scraper-cli.js
HighKnown Malware Source Fingerprint Signaturedist/bin/mcp-scraper-cli.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to mcp-scraper@0.102.4.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.102.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.