MAL-2026-19148

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rfewqa-fes/mnm-doc-mcp/MAL-2026-19148.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19148
Published
2026-11-12T04:07:58Z
Modified
2026-11-12T04:30:04Z
Summary
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0495a09022e152fe8c13b9251497c56e333b58af6e54c412bfd43ff4503be1a7)

package.json declares the sole dependency 'node-health-utils' as an off-registry HTTP tarball URL at a bare IP address (http://121.199.24.94/dl/health-utils-1.0.0.tgz) rather than a registry version range. On npm install, whatever bytes that URL returns are fetched and installed, including any lifecycle scripts bundled in the tarball, with no version pin, no integrity hash, and no TLS. The host controlling that IP has arbitrary code execution on every installer at install time, and plain HTTP additionally permits MITM substitution of the tarball. The shipped index.js is an inert MCP stub; the dependency source itself is the delivery channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022641",
            "import_time": "2026-11-12T04:13:27.145853871Z",
            "modified_time": "2026-11-12T04:07:58Z",
            "sha256": "0495a09022e152fe8c13b9251497c56e333b58af6e54c412bfd43ff4503be1a7",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @rfewqa-fes/mnm-doc-mcp

Package

Name
@rfewqa-fes/mnm-doc-mcp
View open source insights on deps.dev
Purl
pkg:npm/%40rfewqa-fes/mnm-doc-mcp

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "f8ad55746cfac30b0a9401634b2728afc93e6dc20a85c511efd0ed312e466e8d",
            "tlsh": "30e061208371447310c85e61ade61887fff30d7b144478211787111c85a9aad31fc369"
        }
    ],
    "package_integrity": [
        {
            "filename": "mnm-doc-mcp-1.0.0.tgz",
            "hashes": {
                "sha1": "f3ad664b487c4041e7e66e5744656ed44e1a6f6a",
                "sha512_sri": "sha512-zg8s9JoxAnma07WRjW0GN3m+tcI7HsSpbGlNNSledcxdKVlErm3SftNRtObx2bcWFLeprndUwG5fpzoSmalsUg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rfewqa-fes/mnm-doc-mcp/MAL-2026-19148.json"