MAL-2026-16062

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@yongot/canary-mcp-test/MAL-2026-16062.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16062
Published
2026-09-09T01:40:56Z
Modified
2026-09-09T02:00:04Z
Summary
Malicious code in @yongot/canary-mcp-test (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578)

Package @yongot/canary-mcp-test@2.0.0 ships beacon.js which runs execSync('id'), reads os.hostname(), and issues an HTTPS GET to a hardcoded webhook.site collector (https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b) with stage, host, and id_output query parameters. The package.json postinstall hook invokes node beacon.js postinstall, so the beacon fires automatically on npm install. index.js (the package main) also requires beacon.js twice at load time, so any consumer that imports the package re-triggers the same exfiltration of the installer's Unix uid/gid/groups and hostname to the third-party webhook collector.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019747",
            "import_time": "2026-09-09T01:51:48.828770749Z",
            "modified_time": "2026-09-09T01:41:14Z",
            "sha256": "61e758266bf40f886f4877c7930f258ba0eef5b8a3c0da9813e5bf07dd6c2eac",
            "source": "amazon-inspector",
            "versions": [
                "3.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-019745",
            "import_time": "2026-09-09T01:51:48.639256953Z",
            "modified_time": "2026-09-09T01:40:56Z",
            "sha256": "b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578",
            "source": "amazon-inspector",
            "versions": [
                "2.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-019748",
            "import_time": "2026-09-09T01:51:48.92404645Z",
            "modified_time": "2026-09-09T01:41:25Z",
            "sha256": "c3c7b374cb1eac2ee824d10331e9de33285443f9c9d79ff19088a1c85210af54",
            "source": "amazon-inspector",
            "versions": [
                "4.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @yongot/canary-mcp-test

Package

Name
@yongot/canary-mcp-test
View open source insights on deps.dev
Purl
pkg:npm/%40yongot/canary-mcp-test

Affected ranges

Affected versions

2.*
2.0.0
3.*
3.0.0
4.*
4.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "beacon.js",
            "sha256": "ecf9302c65cb1174a70dc74e3145027867fbb691542d809ff83e1b45b65e794d",
            "tlsh": "45f0acb603e89375a4f216c19a1ba69ea37f82003090ddd0a4281192aacac18ce625f2"
        },
        {
            "path": "package.json",
            "sha256": "968906017d62bd4108671b3a83e37072e2cc9aeca275e491b4f175f5d49f5e6d",
            "tlsh": "b4d02b14dd106b7734c40edb1937814faa3a6d2f1244783c93d75059525a3b706bb34f"
        }
    ],
    "package_integrity": [
        {
            "filename": "canary-mcp-test-3.0.0.tgz",
            "hashes": {
                "sha1": "417d4d2a7a72a331c6dfe7a0a0af7e4cba6c5dc1",
                "sha512_sri": "sha512-se7puBEU1IH/IElnzYekk2PTDxZbLAdOdZSMvv7vqFKniD7EH96gtEu/OgFki6KRkciQ7vmVUc0xEfw1QW7+kA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@yongot/canary-mcp-test/MAL-2026-16062.json"