@yongot/canary-mcp-isolation

GHSA-7gq6-vvhp-97f4

Malicious code in @yongot/canary-mcp-isolation (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (1fed7c0ff512ccb2e87647a41a92653138ff50b2be906043aba86ce76b49e340)
The package's postinstall script (beacon.js), also re-executed on require via index.js, sends the installer's hostname, run identifiers, and the output of the `id` shell command to a hardcoded third-party collector at https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b over HTTPS. The same script probes the GCP instance metadata service at 169.254.169.254 and metadata.google.internal with the `Metadata-Flavor: Google` header and reports the status and body back to the webhook, disclosing whether the install environment is a cloud VM and what IMDS returns. Data leaves the installer's host to an attacker-controlled collector automatically on `npm install` and on `require()`, without consent.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/052f71eef3f234515289c1fcfc69fdca0f7048b3/osv/malicious/npm/@yongot/canary-mcp-isolation/MAL-2026-16061.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/052f71eef3f234515289c1fcfc69fdca0f7048b3/osv/malicious/npm/@yongot/canary-mcp-isolation/MAL-2026-16061.json
- https://www.npmjs.com/package/@yongot/canary-mcp-isolation/v/1.0.1
- https://github.com/advisories/GHSA-7gq6-vvhp-97f4

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.