midsummer-sol@0.3.41: Clean npm security report (Allow)

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 1.65 MB of source, external domains: 127.0.0.1, auth.midsummer.new, sol.midsummer.new

Source & flagged code

3 flagged

sol-mcp.jsView file

6341import { join as join10, resolve as resolve2 } from "node:path"; L6342: import { spawn } from "node:child_process"; L6343: function isAutoWatchStopped(solDir2) {

High

Child Process

Package source references child process execution.

sol-mcp.jsView on unpkg · L6341

8495return { configured: false, ok: true }; L8496: const res = spawnSync(cmd, { cwd: cwd2, shell: true, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); L8497: const out = `${res.stdout ?? ""}${res.stderr ?? ""}`;

High

Shell

Package source references shell execution.

sol-mcp.jsView on unpkg · L8495

8470init_auth_cache(); L8471: DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, ""); L8472: DEFAULT_BLIND_PUSH_LIMIT_BYTES = 64 * 1024 * 1024; ... L8475: // src/bin/test-gate.ts L8476: import { spawnSync } from "node:child_process"; L8477: import { existsSync as existsSync16, readFileSync as readFileSync17, unlinkSync as unlinkSync7, writeFileSync as writeFileSync16 } from "node:fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

sol-mcp.jsView on unpkg · L8470

Source & flagged code

3 flagged · loading source

sol-mcp.jsView file

6341import { join as join10, resolve as resolve2 } from "node:path"; L6342: import { spawn } from "node:child_process"; L6343: function isAutoWatchStopped(solDir2) {

High

Child Process

Package source references child process execution.

sol-mcp.jsView on unpkg · L6341

8495return { configured: false, ok: true }; L8496: const res = spawnSync(cmd, { cwd: cwd2, shell: true, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); L8497: const out = `${res.stdout ?? ""}${res.stderr ?? ""}`;

High

Shell

Package source references shell execution.

sol-mcp.jsView on unpkg · L8495

8470init_auth_cache(); L8471: DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, ""); L8472: DEFAULT_BLIND_PUSH_LIMIT_BYTES = 64 * 1024 * 1024; ... L8475: // src/bin/test-gate.ts L8476: import { spawnSync } from "node:child_process"; L8477: import { existsSync as existsSync16, readFileSync as readFileSync17, unlinkSync as unlinkSync7, writeFileSync as writeFileSync16 } from "node:fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

sol-mcp.jsView on unpkg · L8470

Findings

3 High3 Medium4 Low

HighChild Processsol-mcp.js

HighShellsol-mcp.js

HighSame File Env Network Executionsol-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings