Malicious code in xrblocks-mcp (npm)

The npm package xrblocks-mcp was found to contain malicious code embedded in its postinstall lifecycle script. This script executed automatically whenever the package was installed via npm install, without requiring explicit user action or consent.

The malicious script collected sensitive host-identifying information including hostname, platform, architecture, Node.js version, package name, and timestamp. This data was then transmitted via HTTP POST to a hardcoded attacker-controlled endpoint at https://6cjhdzmo.instances.poc.jchunt.top/xrblocks-mcp.

Although the code self-labeled as a 'security research canary', the beacon transmission was unconditional and targeted a hardcoded author-controlled destination. The collected data (particularly os.hostname()) had no legitimate connection to the package's declared functionality, indicating intentional data exfiltration.

The incident was identified and credited to the OpenSSF's malicious-packages repository, which tracks confirmed malicious npm packages.