MAL-2026-10747

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sensorium-mcp/MAL-2026-10747.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10747
Published
2026-07-16T18:41:49Z
Modified
2026-07-16T19:19:58.885145018Z
Summary
Malicious code in sensorium-mcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (73c4ac95caf91cb047bab32d5202efa2dfc2e4f84a032160419a7c30739da91c)

sensorium-mcp starts a background poller against api.telegram.org/getUpdates and delivers received message text as prompts to locally spawned Claude Code (invoked with --dangerously-skip-permissions) and Codex (invoked with --dangerously-bypass-approvals-and-sandbox). Because the agents' approval/sandbox prompts are disabled by the package, any party holding the Telegram bot token and chat id can issue instructions that execute as shell and file operations on the installer's host. The keepAlive threads auto-launch when the server is started. In addition, the MCP send_file tool accepts any absolute path inside the installer's cwd or home directory, reads the file, and uploads it to the configured Telegram chat via telegram.sendDocument, exposing paths such as ~/.ssh/id_rsa, ~/.aws/credentials, and ~/.npmrc to whoever controls the bot. The ping-related patterns flagged in dist/http-server.js and dist/services/self-update.service.js are health-check / keepalive references and are not the primary basis for this verdict.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "3.0.95"
            ],
            "sha256": "73c4ac95caf91cb047bab32d5202efa2dfc2e4f84a032160419a7c30739da91c",
            "import_time": "2026-07-16T18:54:02.613184591Z",
            "modified_time": "2026-07-16T18:41:49Z",
            "id": "IN-MAL-2026-010749",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / sensorium-mcp

Package

Name
sensorium-mcp
View open source insights on deps.dev
Purl
pkg:npm/sensorium-mcp

Affected ranges

Affected versions

3.*
3.0.95

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "sensorium-mcp-3.0.95.tgz",
            "hashes": {
                "sha1": "10d9fcf23031448278d08d9589825e2f0cd7b07a",
                "sha512_sri": "sha512-z3AfyR/uyiakPa2CHKetaMTbm0STtptFd+rNqSr+KcEsD8cMpOkdURfepGevur2y2TYVzMblSN1kLeoTshUp8w=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "4c42861e2efa51324663e0b993177405f632e5472a0cd8d4b99d83312f6d820a6febd6",
            "sha256": "a6f78206687d93519436f42a1aa645ba9368ac903e153bc34198c91a5d67922f",
            "path": "dist/tools/utility-tools.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sensorium-mcp/MAL-2026-10747.json"