Malicious code in mcp-util-helpers (npm)
The npm package mcp-util-helpers contained malicious code in its preinstall hook that performed host reconnaissance and established a remote code execution channel via a hardcoded webhook.site endpoint. The script exfiltrated system information, credentials, and environment variables, and could execute arbitrary commands or download and run remote binaries on installation.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed mcp-util-helpers during the malicious period
- Ecosystems
- Attack vectors
- Affected entities
- mcp-util-helpersnpm package containing malicious preinstall hook
The mcp-util-helpers npm package contained a malicious preinstall script (scripts/check-env.js) that executed during npm install. The script performed extensive host reconnaissance including system user/group information, network configuration, running processes, Docker status, cron jobs, system files (/etc/passwd, /etc/hosts), SSH keys, and environment variables filtered for sensitive data (keys, tokens, passwords, secrets, API credentials, auth tokens).
All collected reconnaissance data was exfiltrated via HTTP POST to a hardcoded webhook.site endpoint (https://webhook.site/0c5803fc-bdd6-4dd0-8c57-68ee0cabac29/the analysis). The script then parsed the webhook response as JSON and implemented a remote code execution channel: if the response contained a cmd field, its value was executed via shell; if it contained a url field, the referenced file was downloaded to /tmp/.mcp-util-setup, made executable, and executed with output POSTed back to the same webhook endpoint.
This represents a complete supply chain compromise combining install-time credential theft with operator-controlled remote code execution. The attack was discovered and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- mcp-util-helpers
- Domains
- webhook.site
Remediation
- Immediately uninstall mcp-util-helpers from all systems
- Audit npm install logs to identify when the package was installed
- Rotate all credentials, API keys, tokens, and secrets that may have been exposed
- Review system logs and process history for suspicious activity during and after installation
- Scan systems for unauthorized binaries in /tmp/.mcp-util-setup or similar locations
- Monitor for unexpected outbound connections to webhook.site or related infrastructure
- Update npm to the latest version and use npm audit to check for other compromised dependencies
- Consider using npm package integrity verification tools and private registries for critical dependencies
Sources
- GitHub Advisory GHSA-76x8-h996-qvxr · GitHub Advisory Database
Cite this entry
"Malicious code in mcp-util-helpers (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-mcp-util-helpers-npm-6d47nb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit