PyPI · pypi.org

word-mcp-live

Py Runtime Dynamic Dangerous Import: Dynamic __import__('sys') — reflection bypass for static checks.

Why PkgRadar flagged 1.6.20

Severity	Signal	Evidence
high	Py Runtime Dynamic Dangerous Import	Dynamic __import__('sys') — reflection bypass for static checks. · word_mcp_live-1.6.20/word_document_server/tools/live_read_tools.py
high	Py Runtime Dynamic Dangerous Import	Dynamic __import__('sys') — reflection bypass for static checks. · word_mcp_live-1.6.20/word_document_server/tools/live_tools.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`1.6.20`	High risk	50	2026-05-30
`1.6.19`	High risk	50	2026-05-30
`1.6.17`	High risk	50	2026-05-30
`1.6.15`	High risk	50	2026-05-30
`1.6.16`	High risk	50	2026-05-30
`1.6.14`	High risk	50	2026-05-30
`1.6.6`	High risk	50	2026-05-30
`1.6.5`	High risk	50	2026-05-30
`1.6.4`	High risk	50	2026-05-30
`1.5.6`	High risk	50	2026-05-30
`1.6.3`	High risk	50	2026-05-30

Block this in CI

PkgRadar gates word-mcp-live (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi word-mcp-live==1.6.20