cube-mcp@0.3.64

CAUTION

Publisher claims: "MCP server for EdgescaleAI Cube cluster management and Apollo deployments" Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher edgescaleai · joined 0 days agoInstalls 14,354Last detonated 59 min ago

Dispute verdict

Behavior trace

Queued for honeypot run · static analysis only

t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL

Pipe-to-shell patternREADME.md:28 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

MEDIUM

Remote installer piped to shellbin/cube-mcp.js:44 · Remote installer piped to shell

AST07

HIGH

npx invocation of non-well-known packageREADME.md:8 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Pipe-to-shell patternbin/cube-mcp.js:44 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

MEDIUM

Remote installer piped to shellREADME.md:28 · Remote installer piped to shell

AST07

HIGH

npx invocation of non-well-known packagebin/cube-mcp.js:54 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:19 · npx invocation of non-well-known package — may execute untrusted code

AST06