PkgRadar

npm · registry.npmjs.org

@sassoftware/mcp-serverjs

Credential File Packaged: package/.env

Why PkgRadar flagged 0.15.2

SeveritySignalEvidence
highCredential File Packagedpackage/.env · package/.env
mediumRemote Payloadmatched "curl " · package/bin/tcurl.sh
mediumRemote Payloadmatched "curl " · package/bin/toolcall.sh

Scanned versions

VersionVerdictScoreScanned (UTC)
0.15.2High risk412026-06-10
0.15.5High risk412026-06-10
0.15.6High risk412026-06-10
0.15.8High risk412026-06-10
0.17.2High risk412026-06-10

Block this in CI

PkgRadar gates @sassoftware/mcp-serverjs (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @sassoftware/[email protected]
Start free — 25 scans / moView full evidence