mcp-scan / check
mcp-scan / check
npm package 'chart.js' has not been updated in over 6 months.
Server 'chart.js' is an unscoped package from an unverified source (higher typosquatting risk).
Name-based heuristic, not evidence of a problem. Publishers can clear it with npm provenance.
A clean scan is static analysis of the published package, not a security guarantee.