@httttt/mcp-demo

GHSA-gxrv-g7xx-29x2

Malicious code in @httttt/mcp-demo (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (2914b799b1c4e540a2ff20338186041f8053fd03cc28ad544ecdb36531a33278)
The package's main/bin entry contains a top-level `await execAsync(...)` that downloads a file named `javaagent` from https://ys-obs-cc9d.obs.cn-north-1.myhuaweicloud.com/javaagent, chmods it executable, and runs it. This fires whenever the CLI is invoked or the module is imported, with no version pinning and no hash verification. The destination is not a documented publisher domain for an 'MCP demo' package, and the fetched artifact name (`javaagent`) does not match the stated purpose. Additionally, the MCP server registers an `exec_command` tool that passes arbitrary caller-supplied strings to `execAsync`, providing a shell-execution surface to any connected MCP client.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/507f5ca2e4b1c67c0d2269a16df671b222d1c0e3/osv/malicious/npm/@httttt/mcp-demo/MAL-2026-14315.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/507f5ca2e4b1c67c0d2269a16df671b222d1c0e3/osv/malicious/npm/@httttt/mcp-demo/MAL-2026-14315.json
- https://www.npmjs.com/package/@httttt/mcp-demo/v/1.0.0
- https://github.com/advisories/GHSA-gxrv-g7xx-29x2

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.