anymd@8.5.5

CAUTION

Publisher claims: "Any file → clean Markdown for AI agents: PDF, Word, PowerPoint, Excel, EPUB, HTML and web pages, images (OCR), audio and video (metadata, subtitles, transcripts). A fast Rust MCP server and CLI that runs on your machine. No API key." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher sylphx · joined 0 days agoInstalls 24,811Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessexec /usr/bin/timeout

0.1sprocessexited 1: If optional dependencies were skipped, reinstall without --no-optional.

0.1sclaimedno tools/list reply (exit 1)

0.1sprocessscript backend runs setup only

Static findings

CRITICAL

HTML comment carrying imperative instructions to the agentREADME.md:7 · HTML comment carrying imperative instructions to the agent

AST01

HIGH

npx invocation of non-well-known packageREADME.md:63 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:57 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:36 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:54 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:35 · npx invocation of non-well-known package — may execute untrusted code

AST06