npm · Malicious package advisory
Malware@yongot/canary-mcp-test
MAL-2026-16062
Malicious code in @yongot/canary-mcp-test (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578) Package @yongot/[email protected] ships beacon.js which runs `execSync('id')`, reads `os.hostname()`, and issues an HTTPS GET to a hardcoded webhook.site collector (https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b) with stage, host, and id_output query parameters. The package.json postinstall hook invokes `node beacon.js postinstall`, so the beacon fires automatically on `npm install`. index.js (the package main) also requires beacon.js twice at load time, so any consumer that imports the package re-triggers the same exfiltration of the installer's Unix uid/gid/groups and hostname to the third-party webhook collector.
Compromised versions (3)
- 3.0.0
- 2.0.0
- 4.0.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.