npm · registry.npmjs.org
mcp-xray-pilot
Credential file access: matched "GITHUB_TOKEN"
Why PkgRadar flagged 0.15.1
| Severity | Signal | Evidence |
|---|---|---|
| high | Credential file access | matched "GITHUB_TOKEN" · package/dist/tools_impl/geocatalogue_fetch.js |
| high | Credential file access | matched "GITHUB_TOKEN" · package/dist/tools_impl/github.js |
| high | Credential file access | matched "GITHUB_TOKEN" · package/dist/tools.js |
| medium | Remote Payload | matched "raw.githubusercontent.com" · package/dist/docs.js |
| medium | Remote Payload | matched "api.github.com/graphql" · package/dist/tools_impl/github.js |
| medium | Remote Payload | matched "curl " · package/dist/tools.js |
| medium | Remote Payload | matched "raw.githubusercontent.com" · package/dist/tools_impl/whitelist_sni_candidates.js |
| medium | Remote Payload | matched "raw.githubusercontent.com" · package/data/docs/_index.json |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
0.15.1 | Review | 98 | 2026-05-24 |
0.15.2 | Review | 98 | 2026-05-24 |
Related campaigns
- beekamai — 2 releases, max score 102
Block this in CI
pkgradar gate --ecosystem npm [email protected]