ICUICU
critical

mcp-hello-world

v1.1.2

A simple Hello World MCP server

npmarvinxxFirst seen Feb 22, 2026

8

Total

1

Critical

4

High

3

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    8:     // Create Express app
    9:     const app = express();
>>> 10:     const port = process.env.PORT || 3000;
    11:     // Server-side connections
    12:     const connections = new Map();
Report false positive
highSC-005Suspicious CommandsMedium ConfidenceLine 0

Node.js child process spawning

Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.

    100: ```typescript
    101: // test/my-mcp-client.test.ts (Example using Jest)
>>> 102: import { spawn } from 'child_process';
    103: import { MCPClient } from '../src/my-mcp-client'; // Assuming this is your client code
    104: 
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �w���*'��(�G� ?��-

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highSC-005Suspicious CommandsMedium ConfidenceLine 0

Node.js child process spawning

Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.

    100: ```typescript
    101: // test/my-mcp-client.test.ts (示例使用 Jest)
>>> 102: import { spawn } from 'child_process';
    103: import { MCPClient } from '../src/my-mcp-client'; // 假设这是你要测试的客户端
    104: 
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �w���*'��(�G� ?��-

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.8 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.8 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 25, 2026critical8
Feb 23, 2026critical8
Feb 22, 2026critical8