rally-project-brain-mcp@0.1.4: Clean npm security report (Allow)

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 23.9 KB of source, external domains: rally-backend.fly.dev

Source & flagged code

1 flagged

index.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const clinebase = process.platform === "win32" ? path.join(process.env.appdata || path.join(os.homedir(), "appdata", "roaming"), "code", "user", "globalstorage") : process.platform === "darwin" ? path.join(os.homedir(), "library", "application support", "code", "user", "globalstorage") : path.join(os.homedir(), ".config", "code", "user", "globalstorage"); const clinepath = path.join(clinebase, "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"); try { const clineextensiondir = path.join(clinebase, "saoudrizwan.claude-dev"); const clineinstalled = await stat(clineextensiondir).then(() => true).catch(() => false); if (cl

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

index.mjsView on unpkg

Source & flagged code

1 flagged · loading source

index.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const clinebase = process.platform === "win32" ? path.join(process.env.appdata || path.join(os.homedir(), "appdata", "roaming"), "code", "user", "globalstorage") : process.platform === "darwin" ? path.join(os.homedir(), "library", "application support", "code", "user", "globalstorage") : path.join(os.homedir(), ".config", "code", "user", "globalstorage"); const clinepath = path.join(clinebase, "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"); try { const clineextensiondir = path.join(clinebase, "saoudrizwan.claude-dev"); const clineinstalled = await stat(clineextensiondir).then(() => true).catch(() => false); if (cl

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code