PkgRadar

PyPI · pypi.org

hermes-mcp-server

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 3.0.2

SeveritySignalEvidence
highPy Runtime Base64 Decodebase64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · hermes_mcp_server-3.0.2/src/hermes_mcp_server/server.py

Scanned versions

VersionVerdictScoreScanned (UTC)
3.0.2High risk302026-06-04
3.0.1High risk302026-06-04
3.0.0High risk302026-06-04
2.2.0High risk302026-06-04
2.1.0High risk302026-06-04
2.0.4Low risk02026-06-04
2.0.3Low risk02026-06-04
2.0.2Low risk02026-06-04
2.0.1Low risk02026-06-04
2.0.0Low risk02026-06-04
1.7.0Low risk02026-06-04
1.6.2Low risk02026-06-04
1.6.1Low risk02026-06-04
1.6.0Low risk02026-06-04
1.5.0Low risk02026-06-04
1.4.2Low risk02026-06-04
1.4.1Low risk02026-06-04
1.4.0Low risk02026-06-04
1.3.2Low risk02026-06-04
1.3.1Low risk02026-06-04
1.3.0Low risk02026-06-04
1.2.1Low risk02026-06-04
1.2.0Low risk02026-06-04
1.1.0Low risk02026-06-04
1.0.3Low risk02026-06-04
1.0.2Low risk02026-06-04
1.0.1Low risk02026-06-04
1.0.0Low risk02026-06-04

Block this in CI

PkgRadar gates hermes-mcp-server (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi hermes-mcp-server==3.0.2