AGENTSCORE-2026-0095
MCP package: @pushary/agent-hooks
Published 8/1/2026 · 0.60.0 → 0.73.0
Withdrawn after review on 2026-09-25
The high-severity findings that triggered this advisory were checked in the package source and are not vulnerabilities. The reasons are listed under each finding below. The advisory stays at this address so the record is not silently rewritten. Reviewed in source: the flagged code was located in the published package, read in context and traced from input to sink (AI-assisted), and every confirmation was re-audited independently.
@pushary/agent-hooks updated from 0.60.0 to 0.73.0. Score changed 80/100 to 70/100 (-10). Risk: MODERATE to MODERATE. 2 findings.
80 → 70
Score
MODERATE → MODERATE
Risk
WARN
Verdict
Findings
- medium no_repository: Package has no repository link — source code is not verifiable
- high command_injection: Potential command injection: shell execution with template literal inputNot a vulnerabilityThe values are constants, the local npm prefix, or commands from the user's own agent configuration.