github JavaScript analyzed 54333a2

sweetrb/apple-numbers-mcp

MCP server for Apple Numbers - read, write, search, and format .numbers spreadsheets via Claude and other AI assistants

Drift inferred · capture-to-capture

HIGH 2026-07-30 code analysis flagged dynamic code execution in sweetrb/apple-numbers-mcp
HIGH 2026-07-17 code analysis flagged dynamic code execution in sweetrb/apple-numbers-mcp
HIGH 2026-07-13 code analysis flagged dynamic code execution in sweetrb/apple-numbers-mcp

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 54333a2 · analyzer v28 · 2d ago

dynamic code execution new Function() sweetrb-apple-numbers-mcp-54333a2/build/index.js :2947 const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);

code evidence vv1.1.10 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 29

fs sweetrb-apple-numbers-mcp-54333a2/build/index.js :21358 import { readFileSync as readFileSync3 } from "node:fs";
fs sweetrb-apple-numbers-mcp-54333a2/src/index.ts :5 import { readFileSync } from "node:fs";
fs sweetrb-apple-numbers-mcp-54333a2/src/services/fileConfig.ts :17 import { existsSync, readFileSync } from "node:fs";
fs sweetrb-apple-numbers-mcp-54333a2/src/services/numbersManager.ts :37 import { existsSync } from "node:fs";
fs sweetrb-apple-numbers-mcp-54333a2/src/tools/doctor.ts :11 import { existsSync } from "node:fs";
fs sweetrb-apple-numbers-mcp-54333a2/src/utils/python.ts :2 import { existsSync, readFileSync } from "node:fs";

shell sweetrb-apple-numbers-mcp-54333a2/build/index.js :7845 var _emojiRegex = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`;
shell sweetrb-apple-numbers-mcp-54333a2/src/utils/applescript.ts :1 import { execFileSync } from "node:child_process";
shell sweetrb-apple-numbers-mcp-54333a2/src/utils/python.ts :1 import { execSync, execFileSync } from "node:child_process";

preinstall (suspicious) sweetrb-apple-numbers-mcp-54333a2/package.json :21 node -e "const fs=require('fs');const ua=process.env.npm_config_user_agent||'';if(fs.existsSync('.git')&&!ua.startsWith('pnpm')){console.error('\nThis repo uses pnpm. npm/yarn resolve dependencies off
prepublishOnly sweetrb-apple-numbers-mcp-54333a2/package.json :38 pnpm run lint && pnpm test && pnpm run build
prepare sweetrb-apple-numbers-mcp-54333a2/package.json :39 husky; pnpm run build