npm-sentinel@1.26.1
CAUTIONPublisher claims: "MCP server that enables intelligent NPM package analysis powered by AI." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry Docker MCP CatalogPublisher nekzus · joined 0 days agoInstalls 61,208Last detonated 32 min ago
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: npx invocation of non-well-known package; Privileged sudo command; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
npx invocation of non-well-known packageREADME.md:66 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Privileged sudo command.github/workflows/publish.yml:57 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05CRITICAL
Privileged sudo command.github/workflows/publish.yml:27 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05CRITICAL
Privileged sudo command.github/workflows/publish.yml:26 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
npx invocation of non-well-known packageCHANGELOG.md:413 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known package__tests__/full-e2e-pack-validation.js:58 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Privileged sudo command.github/workflows/publish.yml:58 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
MCP server using network transport (SSE/HTTP)README.md:67 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
MCP server using network transport (SSE/HTTP)README.md:7 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04HIGH
npx invocation of non-well-known package__tests__/integration/dual-era-pack-e2e.test.ts:73 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
MCP server using network transport (SSE/HTTP)CHANGELOG.md:249 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
MCP server using network transport (SSE/HTTP)CHANGELOG.md:742 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
MCP server using network transport (SSE/HTTP)CHANGELOG.md:278 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
MCP server using network transport (SSE/HTTP)__tests__/full-e2e-pack-validation.js:133 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
MCP server using network transport (SSE/HTTP)llms-full.txt:499 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
MCP server using network transport (SSE/HTTP)llms-full.txt:502 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04HIGH
npx invocation of non-well-known packagepackage.json:37 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
File permission modification commandpackage.json:35 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
MCP server using network transport (SSE/HTTP)__tests__/full-e2e-pack-validation.js:137 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
MCP server using network transport (SSE/HTTP)README.md:9 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
MCP server using network transport (SSE/HTTP)CHANGELOG.md:826 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
File type combined with upload actionsrc/tools/index.ts:424 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
MCP server using network transport (SSE/HTTP)README.md:71 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04HIGH
Access to sensitive file paths__tests__/security/validation.test.ts:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
MCP server using network transport (SSE/HTTP)README.md:8 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Privileged sudo command≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Unclaimed publisher≈ +8 on the totalClaim nekzus: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- npx invocation of non-well-known package≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- File permission modification command≈ +4 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim nekzus