Malicious code in @kolbo/mcp (npm)
The npm package @kolbo/mcp contained malicious code that executed arbitrary second-stage payloads fetched from attacker-controlled C2 servers when the package was invoked. The attack used on-chain Ethereum transaction data to hide C2 endpoints and executed code via eval() and detached child processes.
- Disclosed
- Last updated
- Blast radius
- Any user who installed @kolbo/mcp and invoked it (e.g., via Claude Desktop, Claude Code, or Cursor) had arbitrary code execution on their machine.
- Ecosystems
- Attack vectors
- Affected entities
- @kolbo/mcpnpm package containing malicious code in src/auth.js
The npm package @kolbo/mcp was found to contain malicious code embedded in src/auth.js. After a legitimate OAuth PKCE implementation, the file contained a top-level asynchronous IIFE that executed when the module was required.\n\nThe malicious code queried public Ethereum JSON-RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for transactions from a hardcoded attacker address (0xa322E5f3D311D3080e6f01210063e9aDC2490Ef1). It decoded two IPv4 C2 endpoints from the transaction's to field, fetched XOR-encrypted second-stage JavaScript payloads from http://:443/0x/cls and /0x/ls, decrypted them, and executed them via eval() and detached child processes.\n\nSensitive identifiers (module names, RPC method names, URL paths) were obfuscated using Unicode escape sequences (\uXXXX), and C2 addresses were derived from on-chain data to avoid plain domains or IPs in the source code. The loader was triggered in src/client.js via _ensureLogin, firing on the first API request when the MCP server was invoked (e.g., via npx @kolbo/mcp from Claude Desktop, Claude Code, or Cursor).\n\nThe attack granted the attacker arbitrary code execution on the installer's machine. The incident was discovered and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @kolbo/mcp
- Domains
- eth.blockscout.com
- 1rpc.io
- eth.drpc.org
- ethereum-rpc.publicnode.com
- eth-mainnet.public.blastapi.io
- Hashes
- 4967e165bfca294b333ff71265b77d931215a540b48158d2050a4a516ca51e7c
Remediation
- Immediately uninstall @kolbo/mcp from all systems
- Audit systems that invoked @kolbo/mcp for signs of compromise or unauthorized activity
- Review process logs and network connections from the time of installation and invocation
- Rotate credentials and secrets that may have been exposed
- Monitor for suspicious outbound connections to the identified Ethereum RPC endpoints and any derived C2 addresses
- Update to a clean version of any legitimate MCP package if available, or use an alternative
Sources
- GitHub Advisory GHSA-pm5r-9rq7-j86p · GitHub Advisory Database
Cite this entry
"Malicious code in @kolbo/mcp (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-kolbo-mcp-npm-1mxryy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - activecritical
Malware in @sdgdfgdfhhhfd/multiviewr
Malware discovered in the npm package @sdgdfgdfhhhfd/multiviewr. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package