MAL-2026-6294

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cue-mcp/MAL-2026-6294.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6294
Published
2026-06-23T14:10:26Z
Modified
2026-06-23T14:31:19.960014179Z
Summary
Malicious code in cue-mcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5dce71f7cd453bd73a138279dd78ebc607d7c4f6b171bd3b76c7f456a6eb907a)

The package's postinstall.js script runs automatically on npm install and collects host identifying data (os.hostname()) along with process environment variables (process.env), then transmits the data over HTTPS. This shape — system-information harvesting at install time and outbound network transmission via the https module — is a classic install-time exfiltration pattern. There is no legitimate purpose served by reading the installer's environment variables and hostname during postinstall for a package of this kind. Environment variables on developer and CI machines routinely contain credentials (NPMTOKEN, GITHUBTOKEN, AWS keys, CI secrets), so this beacon constitutes credential exfiltration risk against any system that installs the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "5dce71f7cd453bd73a138279dd78ebc607d7c4f6b171bd3b76c7f456a6eb907a",
            "id": "IN-MAL-2026-007199",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T14:10:26Z",
            "versions": [
                "9999.99.99"
            ],
            "import_time": "2026-06-23T14:23:02.623475392Z"
        }
    ]
}
References
Credits

Affected packages

npm / cue-mcp

Package

Name
cue-mcp
View open source insights on deps.dev
Purl
pkg:npm/cue-mcp

Affected ranges

Affected versions

9999.*
9999.99.99

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cue-mcp/MAL-2026-6294.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "tlsh": "7951d6664a98d2350ba226edf843d4235dbbd05637d698f0b70d52622fc51ac0272bdf",
            "sha256": "c92690a6cce612b551d38a96579679de4391e2815d486dcb146d2c2257db6ead",
            "path": "postinstall.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "cue-mcp-9999.99.99.tgz",
            "hashes": {
                "sha1": "fc918fa13c4975f4f4408d7230cd921166029645",
                "sha512_sri": "sha512-Y5alvnqilj5ZSJXw3qlS8IsxaZRlwPWnLPJvLpADsDvtngpup75hOMUoLmsj134HbqIMb18lL409vQBtS+2F5w=="
            }
        }
    ]
}