{"id":"8c10ce43a8b7","status":"done","kind":"auto","source":"npm","target":"npm:prepublish-mcp","name":"prepublish-mcp","version":"1.0.3","verdict":"COULD NOT RUN","top_finding":null,"findings":2,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-25T19:16:52.573226Z","finished_at":"2026-10-25T19:17:28.494994Z","report_url":"https://detonationlabs.com/r/8c10ce43a8b7","progress":[{"phase":"mcp","label":"baseline","status":"ok","duration":4.7,"new":["dns:mcp.prepublish.ai","ownread:~/.npmrc","write:<skill>/node_modules/.bin/node-which","write:<skill>/node_modules/.bin/prepublish-mcp","write:~/.npm/_logs/*-debug-0.log"],"findings":[],"note":"server did not complete the handshake: no response; server crashed: TypeError: fetch failed; 0 tool calls"},{"phase":"mcp","label":"time-travel","status":"ok","duration":2.5,"new":[],"findings":[],"note":"server did not complete the handshake: no response; server crashed: McpError: MCP error -32001: Request timed out; 0 tool calls"},{"phase":"mcp","label":"ci-github","status":"ok","duration":4.6,"new":[],"findings":[],"note":"server did not complete the handshake: no response; server crashed: TypeError: fetch failed; 0 tool calls"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-25T19:17:27Z","target":{"name":"prepublish-mcp","sha256":"bd5a18204a491022912a471cdb2e4b1b5114585ef74aa1aa54fe953cd2ed3954","files":6,"scripts":["dist/bridge.js"],"declared":{},"trigger_hints":[],"source":"npm:prepublish-mcp@1.0.3","command":"node skill/node_modules/prepublish-mcp/dist/bridge.js","kind":"mcp","version":"1.0.3"},"verdict":"COULD NOT RUN","observed":{"network":["mcp.prepublish.ai"],"files_written":["<skill>/node_modules/.bin/node-which","<skill>/node_modules/.bin/prepublish-mcp","~/.npm/_logs/*-debug-0.log"],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[{"rule":"network-egress","severity":"low","title":"Network destinations contacted","evidence":["mcp.prepublish.ai"],"run_label":"mcp:baseline","confidence":"Info","confidence_reason":"The package connected to these hosts.","why":"Common for tools that fetch data. Check that the hosts fit what the package says it does.","technique":"","description":"Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.","impact":"Context only. Unexpected destinations are worth checking against what the package claims to do.","remediation":"Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.","references":[]},{"rule":"secret-read-by-owner","severity":"low","title":"A tool read its own credentials (e.g. gh, aws, ssh)","evidence":["~/.npmrc (by npm)"],"run_label":"mcp:baseline","confidence":"Info","confidence_reason":"A tool opened its own login or config file, such as npm reading ~/.npmrc.","why":"Normal: that is how the tool works. Listed so nothing is hidden.","technique":"","description":"A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.","impact":"None in itself: this is how those tools work. Listed so the report shows every credential access.","remediation":"No action needed.","references":[]}],"exploration":{"runs":[{"phase":"mcp","target":"prepublish-mcp","label":"baseline","status":"ok","duration":4.691,"new_signatures":["dns:mcp.prepublish.ai","ownread:~/.npmrc","write:<skill>/node_modules/.bin/node-which","write:<skill>/node_modules/.bin/prepublish-mcp","write:~/.npm/_logs/*-debug-0.log"],"findings":2,"note":"server did not complete the handshake: no response; server crashed: TypeError: fetch failed; 0 tool calls","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c export npm_config_update_notifier=false npm_config_audit=...","flag":"","children":[{"kind":"proc","label":"npm rebuild --offline --foreground-scripts --no-audit --no-fund","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm rebuild --offline --foreground-scripts --no-audit","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c node skill/node_modules/prepublish-mcp/dist/bridge.js","flag":"","children":[{"kind":"proc","label":"node skill/node_modules/prepublish-mcp/dist/bridge.js","flag":"","children":[{"kind":"net","label":"mcp.prepublish.ai:443  sent 1609 B","flag":"","children":[],"hot":false},{"kind":"net","label":"DNS lookups for prepublish.ai  2 queries","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"truncated":0}},{"phase":"mcp","target":"prepublish-mcp","label":"time-travel","status":"ok","duration":2.522,"new_signatures":[],"findings":0,"note":"server did not complete the handshake: no response; server crashed: McpError: MCP error -32001: Request timed out; 0 tool calls","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c export npm_config_update_notifier=false npm_config_audit=...","flag":"","children":[{"kind":"proc","label":"npm rebuild --offline --foreground-scripts --no-audit --no-fund","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm rebuild --offline --foreground-scripts --no-audit","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c node skill/node_modules/prepublish-mcp/dist/bridge.js","flag":"","children":[{"kind":"proc","label":"node skill/node_modules/prepublish-mcp/dist/bridge.js","flag":"","children":[{"kind":"net","label":"DNS lookups for prepublish.ai  4 queries","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"truncated":0}},{"phase":"mcp","target":"prepublish-mcp","label":"ci-github","status":"ok","duration":4.641,"new_signatures":[],"findings":0,"note":"server did not complete the handshake: no response; server crashed: TypeError: fetch failed; 0 tool calls","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c export npm_config_update_notifier=false npm_config_audit=...","flag":"","children":[{"kind":"proc","label":"npm rebuild --offline --foreground-scripts --no-audit --no-fund","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm rebuild --offline --foreground-scripts --no-audit","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c node skill/node_modules/prepublish-mcp/dist/bridge.js","flag":"","children":[{"kind":"proc","label":"node skill/node_modules/prepublish-mcp/dist/bridge.js","flag":"","children":[{"kind":"net","label":"mcp.prepublish.ai:443  sent 1609 B","flag":"","children":[],"hot":false},{"kind":"net","label":"DNS lookups for prepublish.ai  2 queries","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"mcp: coverage plateau (2 runs with no new behavior)","model_usage":{"prompt_tokens":0,"completion_tokens":0,"llm_runs":0}},"surface":{},"note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We could not start this server, so none of its behavior was tested. It said: TypeError: fetch failed","recommendation":{"action":"Review","text":"We could not start it, so nothing was tested. Treat it as unverified."},"iocs":{"hosts":[],"ips":[],"sha256":"bd5a18204a491022912a471cdb2e4b1b5114585ef74aa1aa54fe953cd2ed3954","benign_hosts":[]},"coverage":{"runs":3,"phases":["mcp"],"environments":["baseline","time-travel","ci-github"],"tool_calls":0,"model_runs":0,"stopped":"mcp: coverage plateau (2 runs with no new behavior)"},"tree":{"run":"mcp:baseline","roots":[{"kind":"proc","label":"bash -c export npm_config_update_notifier=false npm_config_audit=...","flag":"","children":[{"kind":"proc","label":"npm rebuild --offline --foreground-scripts --no-audit --no-fund","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm rebuild --offline --foreground-scripts --no-audit","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c node skill/node_modules/prepublish-mcp/dist/bridge.js","flag":"","children":[{"kind":"proc","label":"node skill/node_modules/prepublish-mcp/dist/bridge.js","flag":"","children":[{"kind":"net","label":"mcp.prepublish.ai:443  sent 1609 B","flag":"","children":[],"hot":false},{"kind":"net","label":"DNS lookups for prepublish.ai  2 queries","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"prepublish-mcp","version":"1.0.3","files":6,"kind":"mcp"},"install":[],"has_install":true,"run":["node dist/bridge.js"],"tools":[],"tool_calls":0,"agent_runs":0,"network":[{"host":"mcp.prepublish.ai","conns":2,"bytes":3218,"leak":"","when":"while running","dns":false}],"secrets":[{"path":"~/.npmrc","own":true,"when":"during install","leaked":false}],"files":[],"has_graph":true},"confidence":""}}