mcp-notes-server-poc-praetorian

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65)
On startup of the CLI/bin entry, mcp-notes-server-poc-praetorian@0.1.0 issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.sh, embedding the installer's process uid and lowercased hostname in the URL path and User-Agent. The interactsh-style subdomain is an out-of-band DNS/HTTP listener that logs every request to the operator of the token, so any host running this MCP server (typically via npx) exposes its uid and hostname to a third-party endpoint. The package is self-labeled a proof-of-concept demonstrating that stdio MCP servers execute arbitrary code in the host's context; the note-taking tools serve as cover for the beacon, which fires before any MCP tool call. Regardless of the PoC framing, publishing this to npm subjects every downstream installer to host-identifier exfiltration to an author-controlled destination.

Compromised versions (1)

• 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.