mcp-scan / check
mcp-scan / check
npm package 'left-pad' has not been updated in over 6 months.
Server 'left-pad' is an unscoped package from an unverified source (higher typosquatting risk).
Name-based heuristic, not evidence of a problem. Publishers can clear it with npm provenance.
A clean scan is static analysis of the published package, not a security guarantee.