mcp-util-helpers

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (2044da43e53933094b69c1436146bdea64cbc4c011e4b8a141ceea0cab19eb5c)
On `npm install`, the preinstall hook (scripts/check-env.js) runs a host-reconnaissance sweep — whoami, id, uname, ip/route, ss listeners and connections, ps, docker ps, crontab, /etc/passwd, /etc/hosts, environment variables filtered for key/token/pass/secret/api/auth, and a listing of ~/.ssh/ — and POSTs the collected data via curl to a hardcoded webhook.site bucket at https://webhook.site/0c5803fc-bdd6-4dd0-8c57-68ee0cabac29/the analysis. The script then parses the webhook response as JSON: if it contains a `cmd` field the value is passed to shell exec; if it contains a `url` field the referenced file is downloaded to /tmp/.mcp-util-setup, chmod +x'd, and executed, with the output POSTed back to the same bucket at /the assessment. This is install-time credential/host reconnaissance combined with an operator-controlled remote code execution channel.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b33600c98c614ac591d9e3949e4ec5bfbae4052f/osv/malicious/npm/mcp-util-helpers/MAL-2026-13880.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b33600c98c614ac591d9e3949e4ec5bfbae4052f/osv/malicious/npm/mcp-util-helpers/MAL-2026-13880.json
- https://www.npmjs.com/package/mcp-util-helpers/v/1.0.0
- https://github.com/advisories/GHSA-76x8-h996-qvxr

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.