@drawio/mcp

Node.js child process spawning

Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.

    5: import { ListToolsRequestSchema, CallToolRequestSchema } from "@modelcontextprotocol/sdk/types.js";
    6: import pako from "pako";
>>> 7: import { exec } from "child_process";
    8: 
    9: const DRAWIO_BASE_URL = "https://app.diagrams.net/";

Dynamic code execution via exec()

Detected by automated pattern matching (rule SC-003) with medium confidence. May be a false positive.

    30:   }
    31: 
>>> 32:   exec(command, (error) =>
    33:   {
    34:     if (error)

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    107: async function fetchContent(url)
    108: {
>>> 109:   const response = await fetch(url);
    110:   if (!response.ok)
    111:   {

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.