npm JavaScript analyzed 1.6.0

@drawio/mcp

v1.6.0

npm

Official draw.io MCP server for LLMs - Open diagrams in draw.io editor

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.6.0 · analyzer v33 · 8h ago

dynamic code execution indirect eval package/src/elk-engine.js :43 (0, eval)(src);
dynamic code execution indirect eval package/src/libavoid-pass.js :49 (0, eval)(src);

code evidence v1.6.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 14

fs package/src/cdn-cache.js :29 import { mkdirSync, readFileSync, writeFileSync, renameSync, rmSync } from "fs";
fs package/src/index.js :11 import { existsSync, readFileSync, writeFileSync, unlinkSync } from "fs";
fs package/src/pages.js :1 import { readFileSync, writeFileSync, renameSync, unlinkSync } from "fs";