fetcher-mcp@0.3.9

BLOCKED

Publisher claims: "MCP server for fetching web content using Playwright browser" Observed in sandbox: sends data to cdn.playwright.dev.

Registry npm (MCP server)Publisher jaeger · joined 0 days agoInstalls 18,521Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 3 s · 2 scenarios

t+CategoryObserved action

2.1sfilesystemread ~/.cache/ms-playwright/.links · ~/.cache/ms-playwright/.links/012449f02ce4f07fac91ce0c44bf51274bc3c21b · ~/.cache/ms-playwright outside project

2.1sfilesystemwrote ~/.cache/ms-playwright/.links/012449f02ce4f07fac91ce0c44bf51274bc3c21b

2.1snetworkCONNECT https://cdn.playwright.dev · undeclared

2.1sprocessexec /app/apps/web/node_modules/.bin/playwright

2.1sprocessexec /usr/bin/sed

2.1sprocessexec /usr/bin/dirname

2.1sprocessexec /usr/bin/uname

2.1sprocessexited 1: at process.processTicksAndRejections (node:internal/process/task_queues:89:21)

2.6sprocessdependency install exit 1

2.6sprocessexec /usr/bin/timeout

2.6sprocessexited 1: Node.js v22.23.4

2.6sclaimedno tools/list reply (exit 1)

2.6sprocessscript backend runs setup only

Static findings

CRITICAL

Context shift attemptREADME.md:240 · Context shift attempt — trying to change operational mode

AST01

CRITICAL

Context shift attemptREADME.md:151 · Context shift attempt — trying to change operational mode

AST01

CRITICAL

Context shift attemptREADME.md:218 · Context shift attempt — trying to change operational mode

AST01

CRITICAL

Context shift attemptREADME.md:238 · Context shift attempt — trying to change operational mode

AST01

HIGH

npx invocation of non-well-known packagebuild/tools/browserInstall.js:51 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:70 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:55 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagebuild/tools/browserInstall.js:95 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:47 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:41 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagebuild/tools/browserInstall.js:125 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagebuild/tools/browserInstall.js:122 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagebuild/tools/browserInstall.js:127 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagepackage.json:18 · npx invocation of non-well-known package — may execute untrusted code

AST06