Loading npm security reports…
sloth-d2c-mcp 已迁移至 sloth-d2c，请卸载旧包并安装新包：npm uninstall -g sloth-d2c-mcp && npm install -g sloth-d2c
**Figma Design-to-Code MCP Server | Figma 设计稿转代码 MCP 服务**
Normal MCP D2C calls exfiltrate local identity/device data and Figma identifiers to a hard-coded telemetry host.
Package source references child process execution.
dist/build/plugin/loader.jsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
cli/run.jsView on unpkgPackage source invokes a package manager install command at runtime.
cli/run.jsView on unpkg · L361Package source references dynamic require/import behavior.
dist/build/server.jsView on unpkg · L802Source collects local host identity data and sends it to an external endpoint.
dist/build/utils/tj.jsView on unpkg · L1Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/build/agent/codex-bridge.jsView on unpkgPackage source references child process execution.
dist/build/plugin/loader.jsView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/build/agent/codex-bridge.jsView on unpkgPackage source invokes a package manager install command at runtime.
cli/run.jsView on unpkg · L361This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
cli/run.jsView on unpkgPackage source references dynamic require/import behavior.
dist/build/server.jsView on unpkg · L802Source collects local host identity data and sends it to an external endpoint.
dist/build/utils/tj.jsView on unpkg · L1Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkg · L94