Skip to content
Open-Source Registry

npm / @remcp/remcp / 0.2.237

@remcp/remcp 0.2.237

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnsnone
processes
640
operations
37K
packages
32
compiler runs
0
connections
3
build time
30s
job time
30s
capture
284 KB
records
58K
bytes / record
4.9
run 35408470-6748-48c5-a50b-cab34bc0c4cb · built 2026-11-06 · complete View on npm

Graph

egress · medium
2

Checks

15 of 18 clear Network activity Build file changes +1 more
Build behavior▲✓✓✓▲▲✓✓✓✓
Supply chain✓✓✓✓✓✓✓
Pipeline✓

Detections

6
  • Install script installed packages globally: `npm install --global @remcp/remcp@0.2.237 @example/local-runtime@1.2.3 --no-audit --no-fund --ignore…`
    npm
    critical
  • Install script installed packages globally: `npm install --global @remcp/remcp@latest @example/local-runtime@1.2.3 --prefer-online --no-audit --n…`
    npm
    critical
  • Install script installed packages globally: `npm install --global @remcp/remcp@0.2.54 @remcp/runtime@0.2.54 --no-audit --no-fund --ignore-scripts…`
    npm
    critical
  • Install script installed packages globally: `npm install --global @remcp/remcp@0.2.54 @remcp/runtime@0.2.54 --prefer-online --no-audit --no-fund …`
    npm
    critical
  • An install script removed 1 installed file of @remcp/runtime after running
    index.mjs
    high
  • Package code connected to an undeclared host
    remcp.site:443 › remcp.site:443, registry.npmjs.org, registry.npmmirror.com, registry.yarnpkg.com
    medium

Detection

criticalwitnessed

Install script installed packages globally: `npm install --global @remcp/remcp@0.2.237 @example/local-runtime@1.2.3 --no-audit --no-fund --ignore…`

Unexpected build script activity

Subject
/tmp/remcp-cli-path-PAPtod/bin/npm
Jobs
install
Rule
buildscript

Evidence

  1. Ran a package installcause

    ran `npm install --global @remcp/remcp@0.2.237 @example/local-runtime@1.2.3 --no-audit --no-fund --ignore-scripts --loglevel=error`

    by /bin/sh /tmp/remcp-cli-path-PAPtod/bin/npm install --global @remcp/remcp@0.2.237 @example/local-runtime@1.2.3 --no-audit --no-fund --ignore-scripts --loglevel=e…

  2. Written by dependency build codesupport

    script: sh -c node --test test/*.test.mjs

Remediation

A package's install script installed more packages: what they run at install and later is theirs, outside the project's lockfile. Review what was installed, remove it, and replace the package.

Detection

criticalwitnessed

Install script installed packages globally: `npm install --global @remcp/remcp@latest @example/local-runtime@1.2.3 --prefer-online --no-audit --n…`

Unexpected build script activity

Subject
/tmp/remcp-cli-qUgFTg/bin/npm
Jobs
install
Rule
buildscript

Evidence

  1. Ran a package installcause

    ran `npm install --global @remcp/remcp@latest @example/local-runtime@1.2.3 --prefer-online --no-audit --no-fund --ignore-scripts --loglevel=error`

    by /bin/sh /tmp/remcp-cli-qUgFTg/bin/npm install --global @remcp/remcp@latest @example/local-runtime@1.2.3 --prefer-online --no-audit --no-fund --ignore-scripts --…

  2. Written by dependency build codesupport

    script: sh -c node --test test/*.test.mjs

Remediation

A package's install script installed more packages: what they run at install and later is theirs, outside the project's lockfile. Review what was installed, remove it, and replace the package.

Detection

criticalwitnessed

Install script installed packages globally: `npm install --global @remcp/remcp@0.2.54 @remcp/runtime@0.2.54 --no-audit --no-fund --ignore-scripts…`

Unexpected build script activity

Subject
/tmp/remcp-mac-native-first-install-JixKcF/bin/npm
Jobs
install
Rule
buildscript

Evidence

  1. Ran a package installcause

    ran `npm install --global @remcp/remcp@0.2.54 @remcp/runtime@0.2.54 --no-audit --no-fund --ignore-scripts --loglevel=error`

    by /bin/sh /tmp/remcp-mac-native-first-install-JixKcF/bin/npm install --global @remcp/remcp@0.2.54 @remcp/runtime@0.2.54 --no-audit --no-fund --ignore-scripts --lo…

  2. Written by dependency build codesupport

    script: sh -c node --test test/*.test.mjs

Remediation

A package's install script installed more packages: what they run at install and later is theirs, outside the project's lockfile. Review what was installed, remove it, and replace the package.

Detection

criticalwitnessed

Install script installed packages globally: `npm install --global @remcp/remcp@0.2.54 @remcp/runtime@0.2.54 --prefer-online --no-audit --no-fund …`

Unexpected build script activity

Subject
/tmp/remcp-mac-native-update-Tfxk0K/bin/npm
Jobs
install
Rule
buildscript

Evidence

  1. Ran a package installcause

    ran `npm install --global @remcp/remcp@0.2.54 @remcp/runtime@0.2.54 --prefer-online --no-audit --no-fund --ignore-scripts --loglevel=error`

    by /bin/sh /tmp/remcp-mac-native-update-Tfxk0K/bin/npm install --global @remcp/remcp@0.2.54 @remcp/runtime@0.2.54 --prefer-online --no-audit --no-fund --ignore-scr…

  2. Written by dependency build codesupport

    script: sh -c node --test test/*.test.mjs

Remediation

A package's install script installed more packages: what they run at install and later is theirs, outside the project's lockfile. Review what was installed, remove it, and replace the package.

Detection

highwitnessed

An install script removed 1 installed file of @remcp/runtime after running

Build file tampered

Subject
/tmp/remcp-mac-update-rollback-bw3eu9/prefix/lib/node_modules/@remcp/runtime/src/index.mjs
Jobs
install
Rule
build-file-tamper

Evidence

  1. Covered its trackscause

    An install script removed 1 installed file of @remcp/runtime after running

    by /opt/hostedtoolcache/node/24.22.1/x64/bin/node --input-type=module -e import { npmGlobalInstall, npmGlobalUpdate } from "file:///home/runner/work/remcp/remcp/pa…

  2. Written by dependency build codesupport

    script: sh -c node --test test/*.test.mjs

  3. Generated file edited in placesupport

    deleted: /tmp/remcp-mac-update-rollback-bw3eu9/prefix/lib/node_modules/@remcp/runtime/src/index.mjs

    subject /tmp/remcp-mac-update-rollback-bw3eu9/prefix/lib/node_modules/@remcp/runtime/src/index.mjs

Processes

install

node›env›node›…›node›node

Ran
/opt/hostedtoolcache/node/24.22.1/x64/bin/node --input-type=module -e import { npmGlobalInstall, npmGlobalUpdate } from "file:///home/runner/work/remcp/remcp/pa…
Invoked by
node /home/runner/work/_temp/test.js suite package-test /home/runner/work/_temp/tree.json 10
Lineage · 7 processes
  1. nodenode /home/runner/work/_temp/test.js suite package-test /home/runner/work/_temp/tree.json 101670
  2. env/usr/bin/env node /usr/local/bin/npm test --ignore-scripts1677
  3. nodenode /usr/local/bin/npm test --ignore-scripts1677
  4. shsh -c node --test test/*.test.mjs1688
  5. nodenode --test test/agent-auto-update.test.mjs test/agent-deploy-reconnect.test.mjs test/agent-disabled-reconnect.test.mjs test/agent-reconnect-storm.test.mjs test…1689
  6. node/opt/hostedtoolcache/node/24.22.1/x64/bin/node --test-coverage-functions=0 --test-concurrency=0 --inspect-publish-uid=stderr,http --inspect-port=127.0.0.1:9229 …2255
  7. node/opt/hostedtoolcache/node/24.22.1/x64/bin/node --input-type=module -e import { npmGlobalInstall, npmGlobalUpdate } from "file:///home/runner/work/remcp/remcp/pa…2307

Remediation

The package's code covered its tracks: it rewrote what the project declares, or deleted what its install laid down, after running. Restore the project's declaration from version control, treat what the package ran as compromise, and replace the package.

Detection

mediumwitnessed

Package code connected to an undeclared host

Unexpected network connection

Subject
remcp.site:443
Destination
remcp.site:443, registry.npmjs.org, registry.npmmirror.com, registry.yarnpkg.com
Jobs
install
Rule
egress · consumer

Evidence

  1. Connection outside the process’s allowed destinationscause

    opened by node

    subject remcp.site:443

    by node node_modules/.bin/remcp connect

  2. Allowed hostssupport

    Declared or allowed hosts: registry.npmjs.org, registry.npmmirror.com, registry.yarnpkg.com

  3. Why it matterscontext

    The package's own code reached this host while the release ran; no manifest, tool profile, network allowlist entry or accepted download covers it.

What came before it

Loading the graph

Processes

install

node›env›node

Ran
node node_modules/.bin/remcp connect
Invoked by
node /home/runner/work/_temp/run.js @remcp/remcp
Lineage · 3 processes
  1. nodenode /home/runner/work/_temp/run.js @remcp/remcp1503
  2. env/usr/bin/env node node_modules/.bin/remcp connect1534
  3. nodenode node_modules/.bin/remcp connect1534

Remediation

Identify the request. If required, declare the host in the relevant manifest or tool profile, or add a reviewed allow_hosts entry. Otherwise remove it.

Network

3 peers
  • remcp.site:443 @remcp/remcp's own build code · node (consumer) · Cloudflare, Inc. unjudged
  • github.com:443 @remcp/remcp's own build code · git-remote-http via the job's own repository (getremcp/remcp on github.com) · GitHub, Inc. · 2 files infrastructure
  • registry.npmjs.org:8080 the package manager · node (consumer) · 2,789 files ecosystem

Dependencies

41
Dependencies41Build behaviour
@modelcontextprotocol/client2.3.1
@modelcontextprotocol/client2.4.0
@modelcontextprotocol/core2.3.1
@modelcontextprotocol/core2.4.0
cross-spawn7.0.6
eventsource3.0.7
eventsource-parser3.1.1
isexe2.0.0
jose6.2.12
jose6.2.15
path-key3.1.1
pkce-challenge5.0.1
shebang-command2.0.0
shebang-regex3.0.0
uqr0.1.3
which2.0.2
ws8.21.3
ws8.22.1
zod4.6.7
@jellybrick/dbus-next0.11.3
@modelcontextprotocol/server2.3.1
@nodable/entities3.0.0
@pdf-lib/standard-fonts1.0.0
@pdf-lib/upng1.0.1
@remcp/remcp0.2.237
@remcp/runtime
@remcp/runtime0.2.237
anynum1.0.1
consumer1.0.0
consumer-upgrade1.0.0
fast-xml-builder1.3.1
fast-xml-parser5.11.1
is-unsafe2.0.2
macos-temperature-sensor2.1.1
pako1.0.11
path-expression-matcher1.6.2
pdf-lib1.17.1
remcp0.2.237
strnum2.4.2
tslib1.14.1
xml-naming0.3.0

Versions234

Raw data

capture
284 KB
records
58,139
bytes per record
4.9

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: install success · Generated 2026-11-06 · run 35408470-6748-48c5-a50b-cab34bc0c4cb

analysis 0.1.0 · 2026-11-06 · 4346b99 · graph v2