PkgRadar

PyPI · pypi.org

mcp-workstate-orchestrator

Py Runtime Dynamic Dangerous Import: Dynamic __import__('os') — reflection bypass for static checks.

Why PkgRadar flagged 0.7.0

SeveritySignalEvidence
highPy Runtime Dynamic Dangerous ImportDynamic __import__('os') — reflection bypass for static checks. · mcp_workstate_orchestrator-0.7.0/workstate_orchestrator_mcp/orchestration/worker_daemon.py

Scanned versions

VersionVerdictScoreScanned (UTC)
0.7.0High risk302026-06-12
0.6.6High risk302026-06-10
0.6.5High risk302026-06-09
0.6.4High risk302026-06-08
0.6.3High risk302026-06-07
0.6.1High risk302026-06-06
0.6.0High risk302026-06-05
0.5.2High risk302026-06-03
0.5.1High risk302026-06-02
0.5.0High risk302026-05-30
0.4.7High risk302026-05-30

Block this in CI

PkgRadar gates mcp-workstate-orchestrator (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi mcp-workstate-orchestrator==0.7.0
Start free — 25 scans / moView full evidence
mcp-workstate-orchestrator — PyPI security scan | PkgRadar