MAL-2026-4429

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@rui.branco/sentry-mcp/MAL-2026-4429.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4429
Withdrawn
2026-05-26T21:41:23Z
Published
2026-05-21T21:13:02Z
Modified
2026-05-27T00:32:05.714508184Z
Summary
Malicious code in @rui.branco/sentry-mcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8504c65903895f53054fc6df861469ddbac73c130793bd784d47eca8ef2cd65b)

On every load of index.js (the package's main and bin entry), the package queries GitHub for the latest commit SHA on HEAD of rui-branco/sentry-mcp and, if it differs from a locally-stored SHA, spawns a detached background shell that runs npm install -g git+ssh://git@github.com/rui-branco/sentry-mcp.git (index.js:36-43). The git reference is mutable (HEAD, no commit SHA pin), no hash or signature verification is performed, and the install runs silently with stdio: "ignore" and detached: true. The practical consequence is that the npm-published 1.0.4 tarball becomes a perpetual loader: any future commit to the GitHub repo (including commits made by an attacker who compromises the maintainer's GitHub account, independent of npm publishing controls) will be globally installed on every user who runs npx -y @rui.branco/sentry-mcp. The artifact reviewable on npm is not what users actually run after first launch. setup.js additionally writes user-supplied Sentry API tokens to ~/.config/sentry-mcp/config.json without restrictive file permissions (no chmod 0o600) — a secondary hardening concern, not the primary block basis.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-26T05:51:48.634106715Z",
            "sha256": "8504c65903895f53054fc6df861469ddbac73c130793bd784d47eca8ef2cd65b",
            "modified_time": "2026-05-21T21:13:02Z",
            "versions": [
                "1.0.4"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-004033"
        }
    ]
}
References
Credits

Affected packages

npm / @rui.branco/sentry-mcp

Package

Name
@rui.branco/sentry-mcp
View open source insights on deps.dev
Purl
pkg:npm/%40rui.branco%2Fsentry-mcp

Affected ranges

Affected versions

1.*
1.0.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "sentry-mcp-1.0.4.tgz",
            "hashes": {
                "sha1": "772e4b8a7ed9f0eefd370b9d909a814a0ace7eb3",
                "sha512_sri": "sha512-jgXQjg3v3ffsxAocbFPdLZAq1de8GUYgskksO0C+CGYGYkZxGIAWGnc0ZECVcEUu2iKzO0oUAYQEfd/IM/RAbg=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "29032f6c56b5a1261d9ae1784a472006b635a247be2cbc347fdca2500fce05fc2b77bd",
            "sha256": "cc3e5a464762a445e0233c43e0be4cbe672c262f39831e437ee92c6afa260112",
            "path": "index.js"
        },
        {
            "tlsh": "a202431ac3bea927576e1914c5473836ff1a0b437605f92033ace2c84f9941be2a759f",
            "sha256": "31dc6ef41e860794c4a52ee0ccff571f6b785e902ed5187ccde472434dd14d70",
            "path": "setup.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@rui.branco/sentry-mcp/MAL-2026-4429.json"