Loading npm security reports…

midsummer-sol@0.3.60: Suspicious npm security report (Warn) | LPM Firewall

registry / midsummer-sol / 0.3.60

midsummer-sol@0.3.60

Sol — agent-native version control (a new git). CLI, MCP server, and no-filesystem SDK.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 6 file(s), 4.31 MB of source, external domains: 127.0.0.1, auth.midsummer.new, bun.sh, sol.midsummer.new

Source & flagged code

4 flagged

package.jsonView file

Lines 1-30json

2 "name": "midsummer-sol",

3 "version": "0.3.60",

4 "description": "Sol — agent-native version control (a new git). CLI, MCP server, and no-filesystem SDK.",

5 "bin": { "sol": "sol.js", "sol-mcp": "sol-mcp.js", "sol-secret-mcp": "sol-secret-mcp.js" },

6 "main": "./index.js",

7 "exports": { ".": "./index.js" },

8 "type": "module",

9 "files": ["sol.js", "sol-mcp.js", "sol-secret-mcp.js", "index.js", "runtime-check.js", "release-publish-guard.js", "README.md"],

10 "dependencies": { "@modelcontextprotocol/sdk": "^1.29.0" },

11 "optionalDependencies": { "fsevents": "^2.3.3" },

12 "engines": { "bun": ">=1.3.11" },

13 "solRuntime": {

14 "cli": { "engine": "bun", "version": ">=1.3.11" },

15 "sdk": { "engine": "node", "version": ">=20.19.5" }

16 },

17 "keywords": ["vcs", "git", "version-control", "agent", "mcp", "no-filesystem"],

18 "publishConfig": { "access": "public" },

19 "scripts": { "preinstall": "node runtime-check.js", "prepublishOnly": "bun release-publish-guard.js" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 "solRelease": {

21 "protocol": 3,

22 "repositoryId": "zanderreichel:midsummer2",

23 "branch": "staging",

24 "opId": "op_ecdd38df23ec9bcb9a32b8147a2db2f5ad374044efb0bd7ed8d29783e5e193a2",

25 "treeId": "tree_62d96fc4cdb756f54e28b0597e5e6e82b94e9d44be7200d0cb686b8755f758d7",

26 "requiredFeatures": ["hiddenEntriesV1"],

27 "transportFeatures": ["frameBatchV1"]

28 }

29}

sol-mcp.jsView file

5954import { existsSync as existsSync3, lstatSync, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "fs"; L5955: import { spawnSync } from "child_process"; L5956: function die(msg) {

High

Child Process

Package source references child process execution.

sol-mcp.jsView on unpkg · L5954

17794try { L17795: const command = process.platform === "win32" ? spawnSync2("powershell.exe", [ L17796: "-NoProfile",

High

Shell

Package source references shell execution.

sol-mcp.jsView on unpkg · L17794

27648init_private_capture_guard(); L27649: DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, ""); L27650: DEFAULT_BLIND_PUSH_LIMIT_BYTES = 64 * 1024 * 1024; ... L27660: // src/bin/test-gate.ts L27661: import { spawnSync as spawnSync4 } from "child_process"; L27662: import { existsSync as existsSync37, readFileSync as readFileSync39, unlinkSync as unlinkSync14, writeFileSync as writeFileSync29 } from "fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

sol-mcp.jsView on unpkg · L27648

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = node runtime-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

sol-mcp.jsView file

High

Child Process

Package source references child process execution.

sol-mcp.jsView on unpkg · L5954

17794try { L17795: const command = process.platform === "win32" ? spawnSync2("powershell.exe", [ L17796: "-NoProfile",

High

Shell

Package source references shell execution.

sol-mcp.jsView on unpkg · L17794

Findings

4 High3 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsol-mcp.js

HighShellsol-mcp.js

HighSame File Env Network Executionsol-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

package.jsonView file

Lines 1-30json

2 "name": "midsummer-sol",

3 "version": "0.3.60",

4 "description": "Sol — agent-native version control (a new git). CLI, MCP server, and no-filesystem SDK.",

5 "bin": { "sol": "sol.js", "sol-mcp": "sol-mcp.js", "sol-secret-mcp": "sol-secret-mcp.js" },

6 "main": "./index.js",

7 "exports": { ".": "./index.js" },

8 "type": "module",

9 "files": ["sol.js", "sol-mcp.js", "sol-secret-mcp.js", "index.js", "runtime-check.js", "release-publish-guard.js", "README.md"],

10 "dependencies": { "@modelcontextprotocol/sdk": "^1.29.0" },

11 "optionalDependencies": { "fsevents": "^2.3.3" },

12 "engines": { "bun": ">=1.3.11" },

13 "solRuntime": {

14 "cli": { "engine": "bun", "version": ">=1.3.11" },

15 "sdk": { "engine": "node", "version": ">=20.19.5" }

16 },

17 "keywords": ["vcs", "git", "version-control", "agent", "mcp", "no-filesystem"],

18 "publishConfig": { "access": "public" },

19 "scripts": { "preinstall": "node runtime-check.js", "prepublishOnly": "bun release-publish-guard.js" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 "solRelease": {

21 "protocol": 3,

22 "repositoryId": "zanderreichel:midsummer2",

23 "branch": "staging",

24 "opId": "op_ecdd38df23ec9bcb9a32b8147a2db2f5ad374044efb0bd7ed8d29783e5e193a2",

25 "treeId": "tree_62d96fc4cdb756f54e28b0597e5e6e82b94e9d44be7200d0cb686b8755f758d7",

26 "requiredFeatures": ["hiddenEntriesV1"],

27 "transportFeatures": ["frameBatchV1"]

28 }

29}

sol-mcp.jsView file

High

Child Process

Package source references child process execution.

sol-mcp.jsView on unpkg · L5954

17794try { L17795: const command = process.platform === "win32" ? spawnSync2("powershell.exe", [ L17796: "-NoProfile",

High

Shell

Package source references shell execution.

sol-mcp.jsView on unpkg · L17794

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

sol-mcp.jsView on unpkg · L27648