MAL-2026-14228

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/broadcast-graphics-mcp/MAL-2026-14228.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14228
Published
2026-08-19T03:41:11Z
Modified
2026-08-19T04:00:16.943923084Z
Summary
Malicious code in broadcast-graphics-mcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (48987a1a0ccff7dce1134e1a98122cd902961ac34ba623ae0e2fef62f75fe213)

The package's postinstall script runs automatically on npm install and collects host identifiers from the installer machine (os.hostname(), platform, arch, node version, package name, npm lifecycle event, timestamp), then POSTs them as JSON to the hardcoded host 2obx43du.instances.poc.jchunt.top at path /broadcast-graphics-mcp. The destination is not a first-party or user-configurable endpoint; installation of the package unconditionally leaks installer-side identity data to a remote party. The package self-labels as a 'security research canary', but self-labeling does not change the behavior: installing this package causes install-time exfiltration of host metadata to an author-controlled endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T03:49:30.557897707Z",
            "sha256": "48987a1a0ccff7dce1134e1a98122cd902961ac34ba623ae0e2fef62f75fe213",
            "modified_time": "2026-08-19T03:41:11Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018328",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / broadcast-graphics-mcp

Package

Name
broadcast-graphics-mcp
View open source insights on deps.dev
Purl
pkg:npm/broadcast-graphics-mcp

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/broadcast-graphics-mcp/MAL-2026-14228.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "6ff0391e7ffbc5c38047d00dc82b34f4afbed82d54322f6735391ed2dbb18ca9",
            "path": "postinstall.js",
            "tlsh": "ce01fed1d2b55a316bb8a28068e0ae0793faf223370660b679c404e92f8d2f900311ac"
        }
    ],
    "package_integrity": [
        {
            "filename": "broadcast-graphics-mcp-1.0.0.tgz",
            "hashes": {
                "sha1": "f68126e7db311e248e3df7368fb92ddb9ea55440",
                "sha512_sri": "sha512-Ybh6iju9kCPdzDZB4r3hAXnMcRcgBT7r/wCi9K1xQirngA6HTesKGL5XqngmpV2NYMmfRyD2cjOOj/2W8bWu2g=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]