Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the "set_functype_version" MCP tool in "functype-mcp-server" accepts an unconstrained "version" string using only "z.string()" validation in "packages/mcp-server/src/index.ts" and interpolates it into "functype@<version>" for "pnpm add". Package-alias syntaxes such as "file:", "npm:", URLs, or paths can cause an arbitrary local or remote package to be installed as functype. Immediately afterward, "initDocsData(true)" in "packages/mcp-server/src/lib/docs/data.ts" resolves "functype/cli" and dynamically imports the newly installed module, executing attacker-controlled JavaScript with the MCP server process's privileges. Any MCP client able to send a "tools/call" request invoking the tool can exploit the flaw; the tool is enabled by default without authentication in "stdio" mode. A connected AI assistant susceptible to indirect prompt injection can also be induced to invoke it from a malicious document or web page. In non-default "TRANSPORT_TYPE=httpStream" deployments, a network-accessible attacker does not require local access. Successful execution can read process secrets, modify files, or terminate the server. This issue is fixed in "version" 1.4.4.