xmcp
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/host-bridge.js | AI (source-diff): Standard rspack/webpack UMD bundle for the new host-bridge export; not malicious obfuscation. | ai | |
| phantom-deps | phantom-dep:@modelcontextprotocol/sdk | AI (phantom-deps): Core MCP dep referenced in config; stable false positive. | ai | |
| source-diff | net-exec-file:dist/runtime/adapter-fastify.js | AI (source-diff): Network and dynamic-require patterns in bundled adapter are from bundled deps (fastify ecosystem), not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/runtime/adapter-fastify.js | AI (source-diff): File is a standard rspack/webpack UMD bundle of known OSS libraries; minification is expected for this package's build output. | ai | |
| phantom-deps | phantom-dep:swc-loader | AI (phantom-deps): Webpack loader dep; config-referenced, stable false positive. | ai | |
| phantom-deps | phantom-dep:content-type | AI (phantom-deps): HTTP utility dep; config-referenced, stable false positive. | ai | |
| phantom-deps | phantom-dep:@vercel/mcp-adapter | AI (phantom-deps): Framework adapter dep; loaded by convention, stable false positive. | ai | |
| phantom-deps | phantom-dep:webpack-node-externals | AI (phantom-deps): Webpack plugin dep; config-referenced, stable false positive. | ai | |
| phantom-deps | phantom-dep:execa | AI (phantom-deps): Build-tool dep; config-referenced, stable false positive. | ai | |
| phantom-deps | phantom-dep:memfs | AI (phantom-deps): Webpack virtual FS dep; config-referenced, stable false positive. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Config-referenced env loader; stable false positive. | ai | |
| phantom-deps | phantom-dep:raw-body | AI (phantom-deps): HTTP utility dep; config-referenced, stable false positive. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher is GitHub Actions with SLSA provenance attestation; CI/CD publishing is the documented release flow for this package. | ai | |
| phantom-deps | phantom-dep:eslint-config-custom | AI (phantom-deps): ESLint config dep; loaded by convention, not direct import. | ai | |
| phantom-deps | phantom-dep:webpack-virtual-modules | AI (phantom-deps): Webpack plugin dep; used in webpack config, stable FP. | ai | |
| phantom-deps | phantom-dep:@types/webpack-node-externals | AI (phantom-deps): Type-only dep; framework-scoped, stable FP. | ai | |
| phantom-deps | phantom-dep:fork-ts-checker-webpack-plugin | AI (phantom-deps): Webpack plugin dep; used in webpack config, stable FP. | ai | |
| phantom-deps | phantom-dep:@modelcontextprotocol/inspector | AI (phantom-deps): MCP tooling dep; used via config/CLI, not direct import. | ai | |
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): File-watcher dep used in build/dev config; stable FP. | ai | |
| phantom-deps | phantom-dep:del | AI (phantom-deps): Build-tool dep used in config/scripts, not direct import; stable FP for this package. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): CLI/build runner dep; invoked via scripts, not direct import. | ai | |
| phantom-deps | phantom-dep:glob | AI (phantom-deps): Utility used in build config; stable FP. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): CLI output dep; used via config, not direct import. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Framework dep loaded by convention in MCP server context. | ai | |
| phantom-deps | phantom-dep:fs-extra | AI (phantom-deps): Build utility dep; used in config files, not direct import. | ai | |
| phantom-deps | phantom-dep:@swc/core | AI (phantom-deps): Compiler dep invoked via webpack/swc-loader config; stable FP. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): CLI framework dep; used in CLI entry, not direct import detected. | ai | |
| phantom-deps | phantom-dep:cross-env | AI (phantom-deps): Script runner dep; invoked via npm scripts, not direct import. | ai | |
| phantom-deps | phantom-dep:handlebars | AI (phantom-deps): Template engine used in build config; stable FP. | ai | |
| phantom-deps | phantom-dep:@types/express | AI (phantom-deps): Type-only dep; framework-scoped, stable FP. | ai | |
| phantom-deps | phantom-dep:clean-webpack-plugin | AI (phantom-deps): Webpack plugin dep; used in webpack config, not direct import. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() inside a Proxy handler in headers.ts — idiomatic JS, not obfuscation. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used in config parser to evaluate bundled config code — standard pattern for build tool config evaluation. | ai | |
| phantom-deps | phantom-dep:postcss-loader | AI (phantom-deps): postcss-loader referenced in rspack/webpack config, not directly imported in JS source. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): typescript is a build-time dependency used via config/tooling, not directly imported in source. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Used in telemetry tracker for spawning subprocesses; expected for a CLI/build framework tool. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 0.6.10 | 6 / 31 | |
| 0.6.9 | 6 / 30 | |
| 0.6.8 | 6 / 30 | |
| 0.6.7 | 6 / 30 | |
| 0.6.6 | 6 / 30 | |
| 0.6.4 | 6 / 30 | |
| 0.0.17 | 28 / 9 | |
| 0.0.15 | 27 / 9 | |
| 0.0.13 | 25 / 10 | |
| 0.0.9 | 20 / 8 | |
| 0.0.7 | 20 / 8 | |
| 0.0.6 | 20 / 8 | |
| 0.0.5 | 20 / 8 | |
| 0.0.3 | 21 / 8 | |
| 0.0.2 | 21 / 8 |
v0.6.10
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.8
3 findingsThis version was published by a different npm account than previous versions on 2026-04-22. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.7
2 findingsThis version was published by a different npm account than previous versions on 2026-04-16. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.6
2 findingsThis version was published by a different npm account than previous versions on 2026-04-12. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.