open-index/open-npm huggingface dataset:
npm package: @nottiboy1337/mcp-open-registry-poc
Description: PoC: Open Registry supply chain — unvetted server listing (security research)
Latest version: 1.0.0

# Open Registry Supply Chain PoC

Benign PoC for the **Open Registry Supply Chain Risk** finding: anyone with npm + GitHub can publish an MCP server to the open registry (registry.modelcontextprotocol.io) with **no pre-publication review**.

- **Package:** `@nottiboy1337/mcp-open-registry-poc`
- **MCP name:** `io.github.NOTTIBOY137/open-registry-poc`
- **Server:** Minimal benign MCP stdio server (one tool, no sensitive behavior).

Follow **STEP_BY_STEP.md** to run the exploit and prove unvetted listing.
npm package: @nottiboy1337/mcp-update-hijack-demo
Description: Demo: Server update hijack PoC (clean copy for video)
Latest version: 1.0.1

# Server Update Hijack — Demo package (for video)

Clean copy for recording the exploit from step 1.

- **Package:** `@nottiboy1337/mcp-update-hijack-demo`
- **MCP name:** `io.github.NOTTIBOY137/update-hijack-demo`
- **Version:** Start at 1.0.0, then 1.0.1 (no re-review).

See **START_HERE.md** for the exact commands to run in order.
npm package: @nottimtam/console.js
Description: A tiny, dependency-less package for printing pretty, timestamped messages to the console.
Author: NotTimTam
Latest version: 1.1.1

# console.js

A tiny, dependency-less package for printing pretty, timestamped messages to the console.

# Installation

```terminal
npm i @nottimtam/console.js
```

# Usage

## ES6

```js
import { log, warn, success } from "@nottimtam/console.js";

log("This is a regular log.");
warn("This is a warning.");
success("This is a success message!");
```

## CJS

```js
const { log, warn, success } = require("@nottimtam/console.js");

log("This is a regular log.");
warn("This is a warning.");
success("This is a success message!");
```

# Reference

Several methods and resources are exposed by this package.

The `log`, `warn`, `success`, `error`, and `info` methods take a variable number of arguments and display them on the screen in a timestamped, color-coded format.

The `bottom` method does the same, but attempts to log the message at the very bottom of the console. This uses `process.stdout` and is not supported by all console systems.

The `dateString` method returns a formatted date string of the current date/time, in the same format used by the logging methods.

The `colorReference` object stores easy-to-use references for each color used in console logging in case more customization is needed.
npm package: @nottimtam/jtf
Description: Utilities for interacting with .jtf files.
Author: NotTimTam
Latest version: 1.1.12

# JTF

JSON Table Format. An open-source file format for spreadsheets stored in JSON.

[Read the syntax standard.](SYNTAX.md)

[View an example JTF file.](example.jtf)

This repository is a hybrid, it contains the standards and information on the `.jtf` file format, as well as an efficient library of tools for interacting with JTF data.

[Read the wiki.](https://github.com/NotTimTam/jtf/wiki)

## Why JTF?

The `.jtf` format is an attempt at bridging the gap between popular spreadsheet file formats and JavaScript. Complex libraries are generally required to parse `.xlsx` files and their equivalents for use in JavaScript. It is even harder to export content back in to those formats. Formats like `.csv` are far too rudimentary and do not support things like styling and formulas.

`.jtf` data is stored in a familiar and readily accessible structure, **JSON!** Making it somewhat readable in its raw state, and requiring only a small amount of code to properly compile it into a table. `.jtf` data can be stored interchangably within JavaScript objects, `.json` files, and `.jtf` files.

It employs an `.xlsx`-based formula system and a JavaScript-friendly easy-to-use cell targeting system.

This library contains methods for validating, reading, and writing `.jtf` format files **with zero dependencies!**

For custom applications, developers looking to support `.jtf` files in their projects are encouraged to write their own code for interacting with the format.

Contributions to the format and codebase are also welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for more.
npm package: @nottimtam/taskman.js
Description: CRON-scheduled asynchronous task manager.
Author: NotTimTam
Latest version: 1.1.43

# taskman.js

CRON-scheduled asynchronous task manager.

The task manager ensures that a task's callback (even if asynchronous) will not run more than 1 execution concurrently.

# Installation

```terminal
npm i @nottimtam/taskman.js
```

# Usage

## ES6

```js
import TaskMan from "@nottimtam/taskman.js";

const taskManager = new TaskMan();

const task = () => console.log("Hello, world!"); // The callback to run.

taskManager.createTask("my-task", task).schedule("*/5 * * * *"); // Run the task every 5 minutes.
```

## CJS

```js
const { TaskManager } = require("@nottimtam/taskman.js");

const taskManager = new TaskManager();

const task = () => console.log("Hello, world!"); // The callback to run.

taskManager.createTask("my-task", task).schedule("*/5 * * * *"); // Run the task every 5 minutes.
```

# Reference

## Importing in CJS

```js
const { TaskManager, Task } = require("@nottimtam/taskman.js");
```

## Importing in ESM

```js
import TaskManager, { Task } from "@nottimtam/taskman.js";
```

### `TaskManager`

**Description**: Manages tasks to ensure they do not run in parallel.

#### Constructor

-   **`constructor()`**
    -   Initializes an empty task manager.

#### Properties

-   **`tasks`**: An object that stores tasks by their identifier.

#### Methods

-   **`createTask(identifier, callback)`**
    -   Creates a new task with the provided identifier and callback function.
    -   **identifier**: The unique identifier for the task.
    -   **callback**: The asynchronous function associated with the task.
    -   **Returns**: The newly created `Task` instance.

### `Task`

**Description**: Represents a task with a unique identifier and a callback function. It can be initiated manually or scheduled using a cron job.

While tasks can be created and run independently of a task manager, creating them using a TaskManager's `createTask` method will keep your tasks housed in one container.

#### Constructor

-   **`constructor(identifier, callback)`**
    -   **identifier**: A unique identifier for the task (string).
    -   **callback**: The function to be executed when the task is initiated (function).

#### Properties

-   **`identifier`**: The unique identifier for the task.
-   **`callback`**: The function associated with the task.
-   **`running`**: Boolean indicating whether the task is currently running.
-   **`started`**: Timestamp indicating when the task was started.

#### Methods

-   **`initiate()`**

    -   Attempts to start the task. Logs a warning if the task is already running.
    -   **Returns**: A `Promise` that resolves once the task is completed.

-   **`schedule(time = "*/5 * * * *", timeZone = "default")`**
    -   Schedules the task to run based on a cron schedule.
    -   **time**: The cron time string (defaults to every five minutes).
    -   **timeZone**: The timezone in which to operate the job (optional).
    -   **Returns**: The newly created `CronJob` instance.
npm package: @notud/excalidraw
Description: Excalidraw as a React component
Latest version: 0.17.47

# Excalidraw

**Excalidraw** is exported as a component to directly embed in your projects.
This project is a beta version.

## Installation

You can use `npm`

```bash
npm install react react-dom @notud/excalidraw
```

or via `yarn`

```bash
yarn add react react-dom @notud/excalidraw
```

After installation you will see a folder `excalidraw-assets` and `excalidraw-assets-dev` in `dist` directory which contains the assets needed for this app in prod and dev mode respectively.

Move the folder `excalidraw-assets` and `excalidraw-assets-dev` to the path where your assets are served.

By default it will try to load the files from [`https://unpkg.com/@excalidraw/excalidraw/dist/`](https://unpkg.com/@excalidraw/excalidraw/dist)

If you want to load assets from a different path you can set a variable `window.EXCALIDRAW_ASSET_PATH` depending on environment (for example if you have different URL's for dev and prod) to the url from where you want to load the assets.

#### Note

**If you don't want to wait for the next stable release and try out the unreleased changes you can use `@excalidraw/excalidraw@next`.**

## Dimensions of Excalidraw

Excalidraw takes _100%_ of `width` and `height` of the containing block so make sure the container in which you render Excalidraw has non zero dimensions.

### Demo

[Try here](https://codesandbox.io/s/excalidraw-ehlz3).

## Integration

Head over to the [docs](https://docs.excalidraw.com/docs/@excalidraw/excalidraw/integration)

## API

Head over to the [docs](https://docs.excalidraw.com/docs/@excalidraw/excalidraw/api)

## Contributing

Head over to the [docs](https://docs.excalidraw.com/docs/@excalidraw/excalidraw/contributing)