DBPublic database
Every public detonation, with its evidence.
Each package we detonate publicly is listed here with its full report. Search before you install.
- 16
- reports
- 1
- malicious
- 2
- suspicious
- 7
- no malicious behavior
PackageVerdictTop findingConfidenceScanned
mcp-exploit-demogithub
Suspicious
Source code: hidden agent instructions in server.py
Possible
25 Oct 2026
mcp-injection-experimentsgithub
Suspicious
Source code: hidden agent instructions in the server's own code
Possible
25 Oct 2026
Nothing here matches . Detonate it →
"No malicious behavior observed" reports observed behavior only. It does not prove a package is safe.