registry / AI-agent capability abuse / mcp-scraper / 0.90.4

mcp-scraper@0.90.4

Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.

MCP server for MCP Scraper web intelligence tools

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The explicit AI-agent configuration mutation is a dangerous capability that warrants a warning under policy. It is not malicious because the source requires an explicit CLI action and no automatic attack behavior was found.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs mcp-scraper-cli agent install with --apply for Claude Code.

Impact

This changes an AI-agent control surface only after explicit user invocation; no confirmed covert attack surface was established.

Mechanism

The CLI invokes Claude Code commands to replace or add the mcp-scraper user-scope server configuration.

AI rationale

Evidence

dist/bin/mcp-scraper-cli.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The CLI contains an explicit agent-install command that can apply a user-scope Claude Code MCP configuration.
Package metadata exposes the CLI as a user-invoked binary.

Evidence against

package.json contains no preinstall, install, postinstall, or prepare lifecycle hook.
The configuration action is gated by the explicit --apply option and is limited to Claude Code.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 6.70 MB of source, external domains: adstransparency.google.com, analytics.invalid, anthropic.com, api.deepinfra.com, api.jina.ai, api.nango.dev, api.on, api64.ipify.org, blog.modelcontextprotocol.io, cdn.resend.com, chatgpt.com, chatgptguide.ai, chromewebstore.google.com, claude.ai, docs.expo.dev, duckduckgo.com, example.com, fonts.googleapis.com, fonts.gstatic.com, gmail.googleapis.com, hyros-attribution-crm.vercel.app, instagram.com, ipapi.co, ipwho.is, json-schema.org, localsourcebook.com, mcp-field-notes.vercel.app, mcp-scraper-scheduler.vercel.app, mcp-scraper-sms-consent.vercel.app, mcpscraper.dev, medium.com, memory.mcpscraper.dev, modelcontextprotocol.io, old.reddit.com, openidconnect.googleapis.com, openrouter.ai, registry.npmjs.org, resend.com, schema.org, serp-redirector.vercel.app, steenshoney.com, suprmind.ai, techcrunch.com, thorbit.ai, tpc.googlesyndication.com, transparent-commons.cc, web.archive.org, www.facebook.com, www.g2.com, www.google.com

Source & flagged code

13 flagged

dist/chunk-JHMI6HEO.jsView file

1import{c as be}from"./chunk-KJQXUZ4Y.js";import{b as T,l as ve}from"./chunk-2TZBO52D.js";import{a as _e,c as ke,d as X,e as Re,f as Se}from"./chunk-WO3N5FH2.js";function xe(e){retu... L2: `);return["<section>",`<h2>${I(e.title)}</h2>`,'<div class="table-wrap"><table>',`<thead><tr>${e.columns.map(n=>`<th>${I(n)}</th>`).join("")}</tr></thead>`,`<tbody>${t||`<tr><td co...

High

Child Process

Package source references child process execution.

dist/chunk-JHMI6HEO.jsView on unpkg · L1

dist/server-ZZVUT4N6.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = mcp-scraper@0.90.0 matchedIdentity = npm:bWNwLXNjcmFwZXI:0.90.0 similarity = 0.981 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server-ZZVUT4N6.jsView on unpkg

Findings

4 Critical9 High3 Medium5 Low

CriticalSame File Env Network Executiondist/index.cjs

CriticalCredential Exfiltrationdist/index.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

CriticalPrevious Version Dangerous Deltadist/server-ZZVUT4N6.js

HighChild Processdist/chunk-JHMI6HEO.js

HighShell

HighBrowser Session Account Hijackdist/server-ZZVUT4N6.js

HighCredential Redirect Persistencedist/server-ZZVUT4N6.js

HighCommand Output Exfiltrationdist/chunk-LTT2B7NY.js

HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js

HighTrigger Reachable Credential Exfiltrationdist/index.cjs

Affected versions and remediation

This report applies to mcp-scraper@0.90.4.

See all versions of mcp-scraper for other recorded verdicts.

Review the evidence and your use of mcp-scraper@0.90.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 14:17:03.670Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / AI-agent capability abuse / mcp-scraper / 0.90.4

mcp-scraper@0.90.4

Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.

MCP server for MCP Scraper web intelligence tools

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs mcp-scraper-cli agent install with --apply for Claude Code.

Impact

This changes an AI-agent control surface only after explicit user invocation; no confirmed covert attack surface was established.

Mechanism

The CLI invokes Claude Code commands to replace or add the mcp-scraper user-scope server configuration.

AI rationale

Evidence

dist/bin/mcp-scraper-cli.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The CLI contains an explicit agent-install command that can apply a user-scope Claude Code MCP configuration.
Package metadata exposes the CLI as a user-invoked binary.

Evidence against

package.json contains no preinstall, install, postinstall, or prepare lifecycle hook.
The configuration action is gated by the explicit --apply option and is limited to Claude Code.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

13 flagged

dist/chunk-JHMI6HEO.jsView file

High

Child Process

Package source references child process execution.

dist/chunk-JHMI6HEO.jsView on unpkg · L1

dist/server-ZZVUT4N6.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server-ZZVUT4N6.jsView on unpkg

Findings

4 Critical9 High3 Medium5 Low

CriticalSame File Env Network Executiondist/index.cjs

CriticalCredential Exfiltrationdist/index.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

CriticalPrevious Version Dangerous Deltadist/server-ZZVUT4N6.js

HighChild Processdist/chunk-JHMI6HEO.js

HighShell

HighBrowser Session Account Hijackdist/server-ZZVUT4N6.js

HighCredential Redirect Persistencedist/server-ZZVUT4N6.js

HighCommand Output Exfiltrationdist/chunk-LTT2B7NY.js

HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js

HighTrigger Reachable Credential Exfiltrationdist/index.cjs

Affected versions and remediation

This report applies to mcp-scraper@0.90.4.

See all versions of mcp-scraper for other recorded verdicts.

Review the evidence and your use of mcp-scraper@0.90.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 14:17:03.670Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.