MAL-2026-14233

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/code-assist-mcp/MAL-2026-14233.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14233
Published
2026-08-19T03:42:04Z
Modified
2026-08-19T04:00:18.305062660Z
Summary
Malicious code in code-assist-mcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (093f28fd5542ee841027c5b3dc6917a42ac13dd3e0e1d3bf334e87b823886d3c)

code-assist-mcp@1.0.0 runs a postinstall lifecycle script that collects host identifiers (hostname, platform, arch, Node version, package name) and POSTs them as JSON to the hardcoded host m743pyrm.instances.poc.jchunt.top at path /code-assist-mcp. The beacon fires automatically on npm install without user opt-in. The package name resembles Google's platform-ai code-assist tooling, consistent with a dependency-confusion or typosquat reconnaissance beacon confirming code execution on installer build machines.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T03:49:30.77463102Z",
            "sha256": "093f28fd5542ee841027c5b3dc6917a42ac13dd3e0e1d3bf334e87b823886d3c",
            "modified_time": "2026-08-19T03:42:04Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018333",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / code-assist-mcp

Package

Name
code-assist-mcp
View open source insights on deps.dev
Purl
pkg:npm/code-assist-mcp

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/code-assist-mcp/MAL-2026-14233.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "fd38fe87aa69c75ba9acb7afda092e7f3f84207e828dbb6a3d5efe0dd510c78c",
            "path": "postinstall.js",
            "tlsh": "9301fec5d1b95a761bb8a29028f0af0693faf223370620b57ac444a92f8d0f900311ad"
        }
    ],
    "package_integrity": [
        {
            "filename": "code-assist-mcp-1.0.0.tgz",
            "hashes": {
                "sha1": "571ecfda96d4025441fc58a89bed822f88ed9dfe",
                "sha512_sri": "sha512-rtTkgzG8/M4b8ucukgwGS7b/V1oHaPmh1qcDdTeW6xrrmC2cmHLSR4ZpIZLdP9QkFicrW2r9+K9nREtn8SVNuA=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]