registry / sloth-d2c-mcp / 1.0.6-beta.6

sloth-d2c-mcp@1.0.6-beta.6

⚠ Under review

sloth-d2c-mcp 已迁移至 sloth-d2c，请卸载旧包并安装新包：npm uninstall -g sloth-d2c-mcp && npm install -g sloth-d2c

**Figma Design-to-Code MCP Server | Figma 设计稿转代码 MCP 服务**

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 649 KB of source, external domains: 127.0.0.1, api.figma.com, otheve.beacon.qq.com, registry.npmjs.org

Source & flagged code

7 flagged

dist/build/plugin/loader.jsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import { promises as fs } from 'fs';

High

Child Process

Package source references child process execution.

dist/build/plugin/loader.jsView on unpkg · L1

3import * as path from 'path';

4import { fileURLToPath } from 'url';

5import envPaths from 'env-paths';

6import { PLUGIN_HOOKS } from './types.js';

7import { createRequire } from 'module';

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = path.dirname(__filename);

10// 检测是否存在 pnpm

11function hasPnpm() {

12 try {

13 execSync('pnpm --version', { stdio: 'ignore' });

14 return true;

15 }

16 catch {

17 return false;

18 }

19}

20// 获取包管理器命令

21function getPackageManager() {

cli/run.jsView file

Lines 121-161javascript

121 const path = await import('node:path');

122

123 // // 获取当前脚本路径（兼容 Node.js 18）

124 const scriptPath = fileURLToPath

dist/build/server.jsView file

Lines 761-801javascript

761 window.parent.postMessage(

762 {

763 type: 'sloth-d2c:implementation-toolbar-action',

764 payload: {

765 groupIndex,

766 buttonIndex,

767 },

768 },

769 '*',

dist/build/utils/tj.jsView file

Lines 1-21javascript

1import * as os from 'os';

2import axios from 'axios';

3import { Logger } from './logger.js';

4/*

package.jsonView file

Lines 73-105json

73 "react-hot-loader": "~4.13.0",

74 "react-inspector": "~6.0.2",

75 "reflect-metadata": "^0.2.0",

76 "rxjs": "^7.8.1",

77 "sloth-d2c-figma-plugin":

Source & flagged code

7 flagged · loading source

dist/build/plugin/loader.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code