MCP Observatory
1m ago Tracked 59,480 Last 1m ago 24h 2,586
npm JavaScript analyzed 0.3.21

@blaxel/core

v0.3.21
npm

Blaxel Core SDK for TypeScript

maintainer
beamlit-cploujoux
licence
MIT
first seen
2026-05-22
last seen
2026-09-17
releases · 30d
24
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution ×2 in @blaxel/core
capabilities 0 tools
transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

code evidence v0.3.21 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 578

filesystem 10

  • fs (weak) package/dist/cjs-browser/common/env.test.js :39 const node_fs_1 = require("node:fs");
  • fs (weak) package/dist/cjs-browser/image/image.test.js :6 const fs_1 = require("fs");
  • fs (weak) package/dist/cjs/common/env.test.js :39 const node_fs_1 = require("node:fs");
  • fs package/dist/cjs/common/node.js :40 const fsImport = __importStar(require("fs"));
  • fs (weak) package/dist/cjs/image/image.test.js :6 const fs_1 = require("fs");
  • fs (weak) package/dist/esm-browser/common/env.test.js :1 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) package/dist/esm-browser/image/image.test.js :4 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
  • fs (weak) package/dist/esm/common/env.test.js :1 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
  • fs package/dist/esm/common/node.js :3 import * as fsImport from "fs";
  • fs (weak) package/dist/esm/image/image.test.js :4 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";

shell / exec 4

  • shell (weak) package/dist/cjs-browser/sandbox/process/process.js :92 async exec(process) {
  • shell (weak) package/dist/cjs/sandbox/process/process.js :92 async exec(process) {
  • shell (weak) package/dist/esm-browser/sandbox/process/process.js :89 async exec(process) {
  • shell (weak) package/dist/esm/sandbox/process/process.js :89 async exec(process) {

network 38

  • net package/dist/cjs-browser/agents/index.js :47 const response = await fetch(fetchUrl, {
  • net package/dist/cjs-browser/common/controlPlaneFetch.js :49 return globalThis.fetch(input);
  • net package/dist/cjs-browser/common/h2fetch.js :2 export function createH2Fetch(session) { return (input) => globalThis.fetch(input); }
  • net package/dist/cjs-browser/common/sentry.js :326 await fetch(envelopeUrl, {
  • net package/dist/cjs-browser/jobs/start.js :12 const response = await fetch(url);
  • net (weak) package/dist/cjs-browser/sandbox/action.js :164 return globalThis.fetch(input, init);
  • net (weak) package/dist/cjs-browser/sandbox/interpreter.js :104 return globalThis.fetch(input, init);
  • net (weak) package/dist/cjs-browser/sandbox/network/network.js :18 async fetch(port, path = "/", init) {
  • net (weak) package/dist/cjs-browser/sandbox/sandbox.js :193 async fetch(port, path = "/", init) {
  • net package/dist/cjs/agents/index.js :47 const response = await fetch(fetchUrl, {
  • net package/dist/cjs/common/controlPlaneFetch.js :49 return globalThis.fetch(input);
  • net package/dist/cjs/common/h2fetch.js :163 * Creates a fetch()-compatible function that sends requests over an existing
show 26 more
  • net package/dist/cjs/common/sentry.js :326 await fetch(envelopeUrl, {
  • net package/dist/cjs/image/image.js :621 let response = await fetch(`${settings_js_1.settings.baseUrl}/sandboxes/${name}?upload=true`, {
  • net package/dist/cjs/jobs/start.js :12 const response = await fetch(url);
  • net (weak) package/dist/cjs/sandbox/action.js :164 return globalThis.fetch(input, init);
  • net (weak) package/dist/cjs/sandbox/interpreter.js :104 return globalThis.fetch(input, init);
  • net (weak) package/dist/cjs/sandbox/network/network.js :18 async fetch(port, path = "/", init) {
  • net (weak) package/dist/cjs/sandbox/sandbox.js :193 async fetch(port, path = "/", init) {
  • net package/dist/esm-browser/agents/index.js :44 const response = await fetch(fetchUrl, {
  • net package/dist/esm-browser/common/controlPlaneFetch.js :43 return globalThis.fetch(input);
  • net package/dist/esm-browser/common/h2fetch.js :2 export function createH2Fetch(session) { return (input) => globalThis.fetch(input); }
  • net package/dist/esm-browser/common/sentry.js :320 await fetch(envelopeUrl, {
  • net package/dist/esm-browser/jobs/start.js :9 const response = await fetch(url);
  • net (weak) package/dist/esm-browser/sandbox/action.js :157 return globalThis.fetch(input, init);
  • net (weak) package/dist/esm-browser/sandbox/interpreter.js :101 return globalThis.fetch(input, init);
  • net (weak) package/dist/esm-browser/sandbox/network/network.js :15 async fetch(port, path = "/", init) {
  • net (weak) package/dist/esm-browser/sandbox/sandbox.js :157 async fetch(port, path = "/", init) {
  • net package/dist/esm/agents/index.js :44 const response = await fetch(fetchUrl, {
  • net package/dist/esm/common/controlPlaneFetch.js :43 return globalThis.fetch(input);
  • net package/dist/esm/common/h2fetch.js :152 * Creates a fetch()-compatible function that sends requests over an existing
  • net package/dist/esm/common/sentry.js :320 await fetch(envelopeUrl, {
  • net package/dist/esm/image/image.js :615 let response = await fetch(`${settings.baseUrl}/sandboxes/${name}?upload=true`, {
  • net package/dist/esm/jobs/start.js :9 const response = await fetch(url);
  • net (weak) package/dist/esm/sandbox/action.js :157 return globalThis.fetch(input, init);
  • net (weak) package/dist/esm/sandbox/interpreter.js :101 return globalThis.fetch(input, init);
  • net (weak) package/dist/esm/sandbox/network/network.js :15 async fetch(port, path = "/", init) {
  • net (weak) package/dist/esm/sandbox/sandbox.js :157 async fetch(port, path = "/", init) {

secrets 12

  • secrets (weak) package/dist/cjs-browser/common/credentials.test.js :68 process.env.BL_API_KEY = 'test-key';
  • secrets (weak) package/dist/cjs-browser/common/initialize.integration.test.js :24 const apiKey = process.env.TEST_BL_API_KEY;
  • secrets package/dist/cjs-browser/common/webhook.js :18 * secret: process.env.CALLBACK_SECRET!
  • secrets (weak) package/dist/cjs/common/credentials.test.js :68 process.env.BL_API_KEY = 'test-key';
  • secrets (weak) package/dist/cjs/common/initialize.integration.test.js :24 const apiKey = process.env.TEST_BL_API_KEY;
  • secrets package/dist/cjs/common/webhook.js :18 * secret: process.env.CALLBACK_SECRET!
  • secrets (weak) package/dist/esm-browser/common/credentials.test.js :66 process.env.BL_API_KEY = 'test-key';
  • secrets (weak) package/dist/esm-browser/common/initialize.integration.test.js :22 const apiKey = process.env.TEST_BL_API_KEY;
  • secrets package/dist/esm-browser/common/webhook.js :14 * secret: process.env.CALLBACK_SECRET!
  • secrets (weak) package/dist/esm/common/credentials.test.js :66 process.env.BL_API_KEY = 'test-key';
  • secrets (weak) package/dist/esm/common/initialize.integration.test.js :22 const apiKey = process.env.TEST_BL_API_KEY;
  • secrets package/dist/esm/common/webhook.js :14 * secret: process.env.CALLBACK_SECRET!

declared dependencies 23

  • @modelcontextprotocol/sdk@^1.20.0
  • @hey-api/client-fetch@^0.10.0
  • archiver@^7.0.1
  • axios@^1.9.0
  • dockerfile-ast@^0.7.1
  • dotenv@^17.4.2
  • form-data@^4.0.2
  • jwt-decode@^4.0.0
  • smol-toml@^1.8.0
  • uuid@^11.1.0
  • ws@^8.18.2
  • yaml@^2.7.1
show 11 more
  • zod@^3.25.0 || ^4.0.0
  • @eslint/js@^9.26.0
  • @testing-library/dom@^9.3.0
  • @types/archiver@^7.0.0
  • @types/ws@^8.18.1
  • eslint@^9.27.0
  • jsdom@^26.1.0
  • typescript@^5.0.0
  • typescript-eslint@^8.31.1
  • vite@^6.4.3
  • vitest@^4.1.10

perm:untrusted 2

  • untrusted package/dist/cjs/common/h2fetch.js :422 globalThis.fetch(fallbackUrl, fallbackInit).then(resolve, reject);
  • untrusted package/dist/esm/common/h2fetch.js :411 globalThis.fetch(fallbackUrl, fallbackInit).then(resolve, reject);