registry / sloth-d2c-mcp / 1.0.5-beta41

sloth-d2c-mcp@1.0.5-beta41

sloth-d2c-mcp 已迁移至 sloth-d2c，请卸载旧包并安装新包：npm uninstall -g sloth-d2c-mcp && npm install -g sloth-d2c

**Figma Design-to-Code MCP Server | Figma 设计稿转代码 MCP 服务**

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 444 KB of source, external domains: api.figma.com, otheve.beacon.qq.com, registry.npmjs.org

Source & flagged code

9 flagged

dist/build/plugin/loader.jsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import { promises as fs } from 'fs';

High

Child Process

Package source references child process execution.

dist/build/plugin/loader.jsView on unpkg · L1

3import * as path from 'path';

4import { fileURLToPath } from 'url';

5import envPaths from 'env-paths';

6import { PLUGIN_HOOKS } from './types.js';

7import { createRequire } from 'module';

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = path.dirname(__filename);

10// 检测是否存在 pnpm

11function hasPnpm() {

12 try {

13 execSync('pnpm --version', { stdio: 'ignore' });

14 return true;

15 }

16 catch {

17 return false;

18 }

19}

20// 获取包管理器命令

21function getPackageManager() {

Lines 61-101javascript

61}

62// 保存全局插件配置

63async function saveGlobalPluginsConfig(config) {

64 const configPath = getGlobalPluginsConfigPath();

65 // 确保目录存在

66 await fs.mkdir

cli/run.jsView file

Lines 111-151javascript

111 const path = await import('node:path');

112

113 // // 获取当前脚本路径（兼容 Node.js 18）

114 const scriptPath = fileURLToPath

dist/build/utils/tj.jsView file

Lines 1-21javascript

1import * as os from 'os';

2import axios from 'axios';

3import pkg from 'node-machine-id';

4import { Logger } from

markdown/sloth-d2c-skills.zipView file

•path = markdown/sloth-d2c-skills.zip kind = high_entropy_blob sizeBytes = 4288 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

markdown/sloth-d2c-skills.zipView on unpkg

•path = markdown/sloth-d2c-skills.zip kind = compressed_blob sizeBytes = 4288 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

markdown/sloth-d2c-skills.zipView on unpkg

•path = markdown/sloth-d2c-skills.zip kind = nested_archive_needs_inspection sizeBytes = 4288 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

markdown/sloth-d2c-skills.zipView on unpkg

package.jsonView file

Lines 72-100json

72 "react-inspector": "~6.0.2",

73 "reflect-metadata": "^0.2.0",

74 "rxjs": "^7.8.1",

75 "sloth-d2c-figma-plugin": "2.0.3-beta159",

76 "sloth-d2c-node":

Source & flagged code

9 flagged · loading source

dist/build/plugin/loader.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code