fastmcp-ts@1.8.1

BLOCKED

Publisher claims: "🏎️ The official FastMCP TypeScript library - build MCP servers and clients, fast 🏎️" Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher prefecthq · joined 0 days agoInstalls 64,582Last detonated 2 h ago

Dispute verdict

Behavior trace

Queued for honeypot run · static analysis only

t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL

Access to sensitive file pathsdist/cli/entrypoint-runtime.cjs:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:66 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsdist/client.js:888 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Unicode escape sequence detecteddist/zod-P5QUYVPB.js:4288 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

npx invocation of non-well-known packagedist/client.js:1023 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Unicode escape sequence detecteddist/server.js:1331 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

CRITICAL

Destructive file system command detecteddist/server.js:547 · Destructive file system command detected

AST05

CRITICAL

Access to sensitive file pathsdist/cli/entrypoint-runtime.cjs:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/client.js:758 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/server.js:1223 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/client.js:903 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Unicode escape sequence detecteddist/zod-P5QUYVPB.js:4290 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

CRITICAL

Access to sensitive file pathsdist/server.js:494 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Unicode escape sequence detecteddist/zod-P5QUYVPB.js:4301 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

npx invocation of non-well-known packagedist/client.js:1025 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:67 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsdist/server.js:1224 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Unicode escape sequence detecteddist/zod-P5QUYVPB.js:4302 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

npx invocation of non-well-known packagepackage.json:62 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Unicode escape sequence detecteddist/zod-P5QUYVPB.js:4303 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

npx invocation of non-well-known packagepackage.json:64 · npx invocation of non-well-known package — may execute untrusted code

AST06