npm analyzed 1.14.0

@shopify/dev-mcp

v1.14.0

npm

A command line tool for setting up Shopify Dev MCP server

Drift inferred · capture-to-capture

HIGH 2026-06-04 code analysis flagged dynamic code execution in @shopify/dev-mcp

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.14.0 · analyzer v18 · 10h ago

dynamic code executionnew Function()package/dist/index.js:7990const H = new Function(`${r.default.self}`, `${r.default.scope}`, Z)(this, this.scope.get());

code evidence v1.14.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

fs package/dist/index-BynC56Ll.js :4 import { readFileSync as Ge, existsSync as ue, readdirSync as nr } from "fs";
fs package/dist/tools.js :3 import { readFileSync as f } from "fs";

net package/dist/index-BynC56Ll.js :3768 const i = await fetch(n.toString(), {