MCP Observatory
npm analyzed 1.4.1 unconfirmed MCP

@frontmcp/uipack

v1.4.1
npm

FrontMCP UIpack - HTML shell builder, pluggable import resolver, and NPM component loader for MCP UI (React-free core)

maintainer
davidfrontegg
license
Apache-2.0
first seen
2026-06-09
last seen
2026-06-15
releases · 30d
3
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.4.1 · analyzer v18 · 6h ago

skills & prompt files 1

code evidence v1.4.1 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 3

  • fs package/adapters/index.js :2101 const nodeFs = require("fs");
  • fs package/component/index.js :479 const nodeFs = require("fs");
  • fs package/index.js :3399 const nodeFs = require("fs");

shell / exec 4

  • shell package/esm/index.mjs :2007 "child_process",
  • shell package/esm/typings/index.mjs :795 "child_process",
  • shell package/index.js :2124 "child_process",
  • shell package/typings/index.js :855 "child_process",

network 4

  • net package/esm/index.mjs :3210 const response = await fetch(url, { signal: controller.signal });
  • net package/esm/shell/index.mjs :1639 const response = await fetch(url, { signal: controller.signal });
  • net package/index.js :3327 const response = await fetch(url, { signal: controller.signal });
  • net package/shell/index.js :1688 const response = await fetch(url, { signal: controller.signal });

declared dependencies 3

  • zod@^4.0.0
  • typescript@^5.9.3
  • @frontmcp/lazy-zod@1.4.1