Skills/npm/mcp-graphql-enhanced

mcp-graphql-enhanced@4.15.4

BLOCKED

Publisher claims: "mcprush-claim-graphql-enhanced-mcp-724161ab5a07405ea6ceb4f7" Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher letoribo · joined 0 days agoInstalls 105KLast detonated 2 h ago
Dispute verdict

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL
Access to sensitive file pathsdist/worker.js:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageREADME.md:270 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:277 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsdist/index.js:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/worker.js:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/worker.js:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/index.js:78 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageREADME.md:284 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsdist/index.js:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Outbound HTTP to raw IP addressREADME.md:70 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
npx invocation of non-well-known packageREADME.md:290 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:248 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
File permission modification commandpackage.json:35 · File permission modification command — agent changes file ownership/permissions
AST05
HIGH
npx invocation of non-well-known packagedist/helpers/deprecation.js:23 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
URL using raw IP addressREADME.md:70 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
npx invocation of non-well-known packagedist/helpers/deprecation.js:24 · npx invocation of non-well-known package — may execute untrusted code
AST06