mcp-scraper@0.26.3

⚠ Under review

Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.

MCP server for MCP Scraper web intelligence tools

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 19 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 31 file(s), 3.52 MB of source, external domains: adstransparency.google.com, anthropic.com, api.deepinfra.com, api.nango.dev, api64.ipify.org, blog.modelcontextprotocol.io, cdn.resend.com, chatgpt.com, chatgptguide.ai, chromewebstore.google.com, claude.ai, example.com, hyros-attribution-crm.vercel.app, instagram.com, ipapi.co, ipwho.is, mcp-scraper-scheduler.vercel.app, mcpscraper.dev, medium.com, memory.mcpscraper.dev, modelcontextprotocol.io, openrouter.ai, registry.npmjs.org, resend.com, schema.org, steenshoney.com, suprmind.ai, techcrunch.com, thorbit.ai, www.facebook.com, www.g2.com, www.google.com, www.googleapis.com, www.instagram.com, www.mcpscraper.dev, www.trustpilot.com, www.xmlvalidation.com, www.youtube.com, www2.census.gov, yourdomain.com, youtube.com

Oversized source lightweight scan

dist/bin/api-server.cjs2.36 MB file, sampled 256 KB

FilesystemNetworkEnvironmentVarsHighEntropyStringsUrlStringschatgptguide.ai

Source & flagged code

9 flagged

dist/server-GN34MGAE.jsView file

10853contains invisible/control Unicode U+200B (zero width space) const bodyText = rawBodyText.replace(/<U+200B>/g, " ").replace(/\s+/g, " ");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/server-GN34MGAE.jsView on unpkg · L10853

•Trigger-reachable chain: manifest.bin -> dist/bin/api-server.js -> dist/server-GN34MGAE.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server-GN34MGAE.jsView on unpkg

21422patternName = generic_password severity = medium line = 21422 matchedText = url.pass...D]";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/server-GN34MGAE.jsView on unpkg · L21422

Findings

2 Critical5 High5 Medium7 Low

CriticalTrojan Source Unicodedist/server-GN34MGAE.js

CriticalTrigger Reachable Dangerous Capabilitydist/server-GN34MGAE.js

HighChild Processdist/chunk-73YM3DEB.js

HighShell

HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js

HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js

HighOversized Source Filedist/bin/api-server.cjs

MediumSecret Patterndist/server-GN34MGAE.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/bin/api-server.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to mcp-scraper@0.26.3.

See all versions of mcp-scraper for other recorded verdicts.

Review the evidence and your use of mcp-scraper@0.26.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-17 23:09:52.028Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / mcp-scraper / 0.26.3

mcp-scraper@0.26.3

⚠ Under review

Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.

MCP server for MCP Scraper web intelligence tools

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 19 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

Oversized source lightweight scan

dist/bin/api-server.cjs2.36 MB file, sampled 256 KB

FilesystemNetworkEnvironmentVarsHighEntropyStringsUrlStringschatgptguide.ai

Source & flagged code

9 flagged

dist/server-GN34MGAE.jsView file

10853contains invisible/control Unicode U+200B (zero width space) const bodyText = rawBodyText.replace(/<U+200B>/g, " ").replace(/\s+/g, " ");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/server-GN34MGAE.jsView on unpkg · L10853

•Trigger-reachable chain: manifest.bin -> dist/bin/api-server.js -> dist/server-GN34MGAE.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server-GN34MGAE.jsView on unpkg

21422patternName = generic_password severity = medium line = 21422 matchedText = url.pass...D]";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/server-GN34MGAE.jsView on unpkg · L21422

Findings

2 Critical5 High5 Medium7 Low

CriticalTrojan Source Unicodedist/server-GN34MGAE.js

CriticalTrigger Reachable Dangerous Capabilitydist/server-GN34MGAE.js

HighChild Processdist/chunk-73YM3DEB.js

HighShell

HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js

HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js

HighOversized Source Filedist/bin/api-server.cjs

MediumSecret Patterndist/server-GN34MGAE.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/bin/api-server.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to mcp-scraper@0.26.3.

See all versions of mcp-scraper for other recorded verdicts.

Review the evidence and your use of mcp-scraper@0.26.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-17 23:09:52.028Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.