AGENTSCORE-2026-0068
MCP package: @unerr-ai/unerr
Published 6/22/2026 · 0.3.2 → 0.3.4
Withdrawn after review on 2026-09-25
The high-severity findings that triggered this advisory were checked in the package source and are not vulnerabilities. The reasons are listed under each finding below. The advisory stays at this address so the record is not silently rewritten. Reviewed in source: the flagged code was located in the published package, read in context and traced from input to sink (AI-assisted), and every confirmation was re-audited independently.
@unerr-ai/unerr updated from 0.3.2 to 0.3.4. Score changed 65/100 to 60/100 (-5). Risk: ELEVATED to ELEVATED. 4 findings.
65 → 60
Score
ELEVATED → ELEVATED
Risk
WARN
Verdict
Findings
- low install_script: Package has 'postinstall' script: test -d vendor/contracts/src && NODE_AUTH_TOKEN=${NODE_AUTH_TOKEN:-} pnpm -C vendor/contracts install --ignore-workspace --prefer-offline && NODE_AUTH_TOKEN=${NODE_AUTH_TOKEN:-} pnpm -C vendor/contrac
- medium excessive_dependencies: Package has 40 runtime dependencies (high attack surface)
- high command_injection: Potential command injection: shell execution with template literal inputNot a vulnerabilityOne match is SQL built from a constant column list, not a shell. The others take the local npm prefix or the user's own shell setting.
- low no_provenance: Package is not published with provenance attestations or trusted publishing. Published by: jaswanth-unerr