npm · mcp-datetime0.2.0

Evidence

],

  "scripts": {

    "build": "tsc && shx chmod +x dist/*.js",

    "prepare": "npm run build",

    "watch": "tsc --watch",

    "start": "node dist/index.js",

    "start:sse": "node dist/index.js --sse",

RemediationAI

The problem is that the 'prepare' script in package.json automatically runs 'npm run build' during package installation, executing arbitrary TypeScript compilation and file permission changes on every install without user awareness or consent. Remove the 'prepare' key from the scripts object in package.json, or replace it with a no-op script like '"prepare": "echo skip"', so that compilation only happens when developers explicitly run 'npm run build'. This eliminates the supply-chain risk where a compromised build step could inject malicious code into every installation. Verify the fix by running 'npm install' in a clean environment and confirming that dist/ files are not auto-generated; then confirm that 'npm run build' still works when called explicitly.