DBPublic database
Every public detonation, with its evidence.
Each package we detonate publicly is listed here with its full report. Search before you install.
- 16
- reports
- 1
- malicious
- 2
- suspicious
- 7
- no malicious behavior
PackageVerdictTop findingConfidenceScanned
mcp-injection-experimentsgithub
Malicious
Agent read credential files through another server's tool, unasked
Confirmed
25 Oct 2026
Nothing here matches . Detonate it →
"No malicious behavior observed" reports observed behavior only. It does not prove a package is safe.