Skills/npm/hostinger-api-mcp

hostinger-api-mcp@3.8.1

CAUTION

Publisher claims: "MCP server for Hostinger API" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher hostinger · joined 0 days agoInstalls 741KLast detonated 2 h ago
Dispute verdict

Behavior trace

Honeypot run · 1 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only

Static findings

CRITICAL
Access to sensitive file pathsREADME.md:102 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsREADME.md:196 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.ts:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.js:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsREADME.md:2295 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/instructions.agency-hosting.ts:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.js:351 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.ts:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsbuild.js:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsbuild.js:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.js:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.js:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.ts:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsREADME.md:2274 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsbuild.js:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/instructions.agency-hosting.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsbuild.js:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/instructions.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.js:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/instructions.ts:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.ts:123 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.js:81 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.ts:329 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.js:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.js:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.js:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.js:659 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/oauth.ts:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.ts:122 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/skills.js:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/skills.ts:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.ts:124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.ts:161 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/runtime.ts:696 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/tools/hosting.js:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathstypes.d.ts:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
File permission modification commandDockerfile:13 · File permission modification command — agent changes file ownership/permissions
AST05
HIGH
npx invocation of non-well-known packagepackage.json:39 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathssrc/core/tools/hosting.ts:2778 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packagebuild.js:19 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathssrc/core/tools/hosting.ts:2814 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathstypes.d.ts:4789 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/tools/hosting.js:2798 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packagesrc/core/instructions.agency-hosting.js:2 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathssrc/core/tools/hosting.js:2762 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathstypes.d.ts:4820 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/core/tools/hosting.ts:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
MEDIUM
URL using raw IP addresssrc/core/oauth.ts:171 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
npx invocation of non-well-known packagesrc/core/instructions.agency-hosting.ts:2 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagesrc/core/instructions.js:2 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
URL with embedded credentialssrc/core/oauth-error.html:9 · URL with embedded credentials — may be phishing or credential leaking
AST07
HIGH
Outbound HTTP to raw IP addresssrc/core/oauth.js:299 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addresssrc/core/skills.js:105 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
File type combined with upload actionskills/headless/run-log.mjs:648 · File type combined with upload action — agent may exfiltrate local data files
AST07
HIGH
npx invocation of non-well-known packagesrc/core/skills.js:70 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Outbound HTTP to raw IP addresssrc/core/oauth.ts:279 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
npx invocation of non-well-known packagesrc/core/skills.js:77 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
URL using raw IP addresssrc/core/oauth.js:169 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
npx invocation of non-well-known packagesrc/core/skills.ts:91 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagesrc/core/skills.ts:84 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagesrc/core/instructions.ts:2 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Outbound HTTP to raw IP addresssrc/core/skills.ts:119 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
URL with embedded credentialssrc/core/oauth-success.html:9 · URL with embedded credentials — may be phishing or credential leaking
AST07
HIGH
Outbound HTTP to raw IP addresssrc/core/oauth.ts:171 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
URL using raw IP addresssrc/core/oauth.js:299 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Outbound HTTP to raw IP addresssrc/core/oauth.js:169 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
URL using raw IP addresssrc/core/oauth.ts:279 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addresssrc/core/skills.js:105 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
File type combined with upload actionsrc/core/skills.js:47 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/runtime.ts:522 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/runtime.ts:550 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/skills.js:77 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.js:84 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
File type combined with upload actionsrc/core/skills.js:63 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.js:105 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
File type combined with upload actionsrc/core/runtime.js:432 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/skills.js:105 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/runtime.js:468 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/runtime.js:485 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/runtime.js:494 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/runtime.ts:505 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/skills.js:126 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/runtime.ts:463 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.js:70 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.js:91 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.js:98 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
File type combined with upload actionsrc/core/skills.ts:61 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/runtime.js:513 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/runtime.ts:531 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
URL using raw IP addresssrc/core/skills.ts:119 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
File type combined with upload actionsrc/core/skills.ts:77 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actiontypes.d.ts:136 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.ts:98 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
File type combined with upload actionsrc/core/tools/hosting.ts:2682 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/tools/hosting.js:2666 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.ts:84 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
File type combined with upload actionsrc/core/tools/hosting.ts:359 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/tools/hosting.ts:2636 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.ts:119 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
File type combined with upload actionsrc/core/tools/hosting.js:172 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/skills.ts:119 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.ts:105 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
File type combined with upload actionsrc/core/tools/hosting.ts:188 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/tools/hosting.js:2620 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/skills.ts:91 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/core/skills.ts:112 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
File type combined with upload actionsrc/core/tools/hosting.js:343 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionsrc/core/skills.ts:140 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actiontypes.d.ts:224 · File type combined with upload action — agent may exfiltrate local data files
AST07
LOW
Unpinned dependencysrc/core/skills.ts:84 · Unpinned dependency
AST06
LOW
Unpinned dependencysrc/core/skills.js:70 · Unpinned dependency
AST06
LOW
Unpinned dependencysrc/core/skills.ts:119 · Unpinned dependency
AST06
LOW
Unpinned dependencysrc/core/skills.js:105 · Unpinned dependency
AST06