midsummer-sol@0.3.53: Clean npm security report (Allow)

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 4 file(s), 2.51 MB of source, external domains: 127.0.0.1, auth.midsummer.new, sol.midsummer.new

Source & flagged code

3 flagged

sol-mcp.jsView file

5714import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync7, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "node:fs"; L5715: import { spawnSync } from "node:child_process"; L5716: function die(msg) {

High

Child Process

Package source references child process execution.

sol-mcp.jsView on unpkg · L5714

11454return { configured: false, ok: true }; L11455: const res = spawnSync2(cmd, { cwd: cwd2, shell: true, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); L11456: const out = `${res.stdout ?? ""}${res.stderr ?? ""}`;

High

Shell

Package source references shell execution.

sol-mcp.jsView on unpkg · L11454

11428init_private_capture_guard(); L11429: DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, ""); L11430: DEFAULT_BLIND_PUSH_LIMIT_BYTES = 64 * 1024 * 1024; ... L11434: // src/bin/test-gate.ts L11435: import { spawnSync as spawnSync2 } from "node:child_process"; L11436: import { existsSync as existsSync21, readFileSync as readFileSync21, unlinkSync as unlinkSync8, writeFileSync as writeFileSync17 } from "node:fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

sol-mcp.jsView on unpkg · L11428

Source & flagged code

3 flagged · loading source

sol-mcp.jsView file

5714import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync7, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "node:fs"; L5715: import { spawnSync } from "node:child_process"; L5716: function die(msg) {

High

Child Process

Package source references child process execution.

sol-mcp.jsView on unpkg · L5714

11454return { configured: false, ok: true }; L11455: const res = spawnSync2(cmd, { cwd: cwd2, shell: true, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); L11456: const out = `${res.stdout ?? ""}${res.stderr ?? ""}`;

High

Shell

Package source references shell execution.

sol-mcp.jsView on unpkg · L11454

11428init_private_capture_guard(); L11429: DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, ""); L11430: DEFAULT_BLIND_PUSH_LIMIT_BYTES = 64 * 1024 * 1024; ... L11434: // src/bin/test-gate.ts L11435: import { spawnSync as spawnSync2 } from "node:child_process"; L11436: import { existsSync as existsSync21, readFileSync as readFileSync21, unlinkSync as unlinkSync8, writeFileSync as writeFileSync17 } from "node:fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

3 High3 Medium5 Low

HighChild Processsol-mcp.js

HighShellsol-mcp.js

HighSame File Env Network Executionsol-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License