Loading npm security reports…

midsummer-sol: Suspicious npm security report (Warn) | LPM Firewall

registry / midsummer-sol / 0.3.68

midsummer-sol@0.3.68

Sol — agent-native version control (a new git). CLI, MCP server, and no-filesystem SDK.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 4 file(s), 844 KB of source, external domains: auth.midsummer.new, bun.sh, sol.midsummer.new

Oversized source lightweight scan

sol-mcp.js2.08 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellObfuscatedHighEntropyStringsUrlStringssol.midsummer.new

sol.js2.08 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVars

Source & flagged code

3 flagged

package.jsonView file

Lines 1-30json

2 "name": "midsummer-sol",

3 "version": "0.3.68",

4 "description": "Sol — agent-native version control (a new git). CLI, MCP server, and no-filesystem SDK.",

5 "bin": { "sol": "sol.js", "sol-mcp": "sol-mcp.js", "sol-secret-mcp": "sol-secret-mcp.js" },

6 "main": "./index.js",

7 "exports": { ".": "./index.js" },

8 "type": "module",

9 "files": ["sol.js", "sol-mcp.js", "sol-secret-mcp.js", "index.js", "runtime-check.js", "release-publish-guard.js", "README.md"],

10 "dependencies": { "@modelcontextprotocol/sdk": "^1.29.0" },

11 "optionalDependencies": { "fsevents": "^2.3.3" },

12 "engines": { "bun": ">=1.3.11" },

13 "solRuntime": {

14 "cli": { "engine": "bun", "version": ">=1.3.11" },

15 "sdk": { "engine": "node", "version": ">=20.19.5" }

16 },

17 "keywords": ["vcs", "git", "version-control", "agent", "mcp", "no-filesystem"],

18 "publishConfig": { "access": "public" },

19 "scripts": { "preinstall": "node runtime-check.js", "prepublishOnly": "bun release-publish-guard.js" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 "solRelease": {

21 "protocol": 3,

22 "repositoryId": "zanderreichel:midsummer2",

23 "branch": "staging",

24 "opId": "op_676d2bd8f0cdf1ba728d786712f1d4bb08b4e1023b19d369d6cd664fb41b6d30",

25 "treeId": "tree_bb14a72e1b9b2ea7fbde2425d97169a6e9399783a256344b282f7addaaa720ef",

26 "requiredFeatures": ["hiddenEntriesV1"],

27 "transportFeatures": ["frameBatchV1"]

28 }

29}

sol-mcp.jsView file

•path = sol-mcp.js kind = oversized_source_file sizeBytes = 2176943 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

sol-mcp.jsView on unpkg

•path = sol-mcp.js kind = oversized_cli_entrypoint sizeBytes = 2176943 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

sol-mcp.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.preinstall = node runtime-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

sol-mcp.jsView file

•path = sol-mcp.js kind = oversized_source_file sizeBytes = 2176943 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

sol-mcp.jsView on unpkg

•path = sol-mcp.js kind = oversized_cli_entrypoint sizeBytes = 2176943 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

sol-mcp.jsView on unpkg

Findings

2 High4 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filesol-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointsol-mcp.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License