mcp-scraper@0.89.4
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not concrete install-time malware, but it packages an authenticated browser-agent capability with persistent profiles. The capability warrants a warning because compromise or misuse of an enabled MCP client could affect logged-in accounts.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user configures and starts the MCP server, then invokes browser profile or browser-control tools.
Impact
An agent granted access could act through a user's authenticated web sessions.
Mechanism
Hosted browser sessions with saved authenticated profiles.
AI rationale
This is not concrete install-time malware, but it packages an authenticated browser-agent capability with persistent profiles. The capability warrants a warning because compromise or misuse of an enabled MCP client could affect logged-in accounts.
Evidence
package.jsondist/server-RORLM2FG.jsREADME.md
Network endpoints1
mcpscraper.dev
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest exposes an MCP stdio server and a browser-agent command.
- The bundled server presents a login flow whose session is saved to a profile.
- The package describes hosted profile connections that can hold authenticated logins for multiple domains.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle script.
- No automatic credential exfiltration, shell execution, or foreign configuration mutation was confirmed during inspection.
- The Claude configuration change is behind an explicit CLI --apply action, not package installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
13 flaggeddist/bin/mcp-scraper-cli.jsView file
1#!/usr/bin/env node
L2: import{b as E,c as N,d as M,e as L,f as T,j as U}from"../chunk-XLWNEVUZ.js";import"../chunk-KJQXUZ4Y.js";import"../chunk-3GP5CYZX.js";import{g as v,j as b,k as D,l as K,m as H}from...
L3: `)){let l=a.match(/^\s{2,}([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);if(!l){if(a.trim().length&&!/^\s{2,}/.test(a))break;continue}p[l[1]]=l[2]}return{command:n,args:i,env:p}}function j(e){le...
High
Child Process
Package source references child process execution.
dist/bin/mcp-scraper-cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import{b as E,c as N,d as M,e as L,f as T,j as U}from"../chunk-XLWNEVUZ.js";import"../chunk-KJQXUZ4Y.js";import"../chunk-3GP5CYZX.js";import{g as v,j as b,k as D,l as K,m as H}from...
L3: `)){let l=a.match(/^\s{2,}([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);if(!l){if(a.trim().length&&!/^\s{2,}/.test(a))break;continue}p[l[1]]=l[2]}return{command:n,args:i,env:p}}function j(e){le...
L4: `):c==="claude"?["# Claude Code command",a,i.exactConfig,"","# One-command Claude Code setup",u,"",`Continuation: ${i.continuation}`,`Rollback: ${i.rollback}`,"",p].join(`
L5: `):c==="claude-desktop"?["# Claude Desktop config",a,i.exactConfig,"","Desktop Extension: https://mcpscraper.dev/downloads/mcp-scraper.mcpb",`Continuation: ${i.continuation}`,`Roll...
L6: `):[`# ${i.label} MCP config`,a,
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/bin/mcp-scraper-cli.jsFindings
4 Critical8 High3 Medium4 Low
CriticalSame File Env Network Executiondist/index.cjs
CriticalCredential Exfiltrationdist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/server-RORLM2FG.js
HighChild Processdist/bin/mcp-scraper-cli.js
HighBrowser Session Account Hijackdist/server-RORLM2FG.js
HighCredential Redirect Persistencedist/server-RORLM2FG.js
HighCommand Output Exfiltrationdist/chunk-QPWPR5XG.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to mcp-scraper@0.89.4.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.89.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.