nordic-data-mcp

workspace0168 files scannedMay 23, 2026

Do not install this package

We found dangerous patterns that could harm your computer or steal your data. This package runs hidden code automatically when you install it. Unless you are 100% sure you trust the author and have reviewed the code yourself, do not install this.

What We Found(6 issues)

Each card explains what was found and what it means in plain English. Click "Technical details" for the full breakdown.

CRITICALCRIT-001

DO NOT INSTALL. This package runs hidden code the moment you type npm install — before you can even look at what's inside. It downloads and executes a script from the internet automatically. This is the #1 way malware spreads through npm.

Technical details

Lifecycle script (preinstall/postinstall/install) executes shell commands. This is the #1 vector for npm supply chain attacks — code runs automatically on install.

"preinstall": "sh -c 'rm -f package-lock.json yarn.lock; case \"

package.json:6

CRITICALCRIT-002

DO NOT INSTALL. This package runs code BEFORE you can even see what it does. Almost no legitimate package needs this. It's like a delivery driver demanding to enter your house before you can check what's in the box.

Technical details

Any preinstall script is suspicious. Legitimate packages almost never need to run code before installation. This hook executes before the user can inspect the package.

"preinstall": "sh -c 'rm -f package-lock.json yarn.lock; case \"

package.json:6

HIGHHIGH-003

Caution. This package runs system commands on your computer. This is like giving someone the keys to your terminal. They could run anything — download files, change settings, or access your private data.

Technical details

Direct process execution functions (exec, spawn) can run arbitrary commands. Combined with user input, this enables remote code execution.

spawn(

nordic-data-mcp/scripts/smoke-test.mjs:15

HIGHHIGH-003

Technical details

Direct process execution functions (exec, spawn) can run arbitrary commands. Combined with user input, this enables remote code execution.

exec(

nordic-data-mcp/src/http.ts:139

HIGHHIGH-005

Caution. This package reads your secret passwords and API tokens from your system. If it also has network access, your credentials could be sent to someone else's server. Check WHY it needs your secrets.

Technical details

Reading sensitive environment variables (tokens, secrets, keys, passwords) suggests data exfiltration. MCP servers should declare required env vars, not silently read secrets.

process.env.NORDIC_API_KEY

nordic-data-mcp/src/lib/apiClient.ts:31

MEDIUMMED-004

Suspicious. This package loads code from an unknown location decided at runtime. We can't tell what it will actually run because it depends on a variable. This makes it harder to verify the package is safe.

Technical details

Dynamic require/import with variable arguments loads code determined at runtime. This can be used to load payloads that static analysis can't detect.

import($

artifacts/mockup-sandbox/mockupPreviewPlugin.ts:58

Finding Summary

Critical

High

Medium

Low

Info