MAL-2026-12401

    Dashboard / Malicious Package / MAL-2026-12401

    MAL-2026-12401

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in mcp-audit-sync-internal (npm)

    Details: Source: amazon-inspector (897822fdfb08c83d7d949c16e497d6897b9b679cc2f05a0409b1ec369a1f10fc) [email protected] declares scripts.preinstall = 'node index.js'. On Windows, index.js spawns a hidden PowerShell process that fetches a ZIP from https://files.catbox.moe/5khq55.zip, expands it into %TEMP%, and then Start-Process's the extracted Verification_Tool.exe. The remote artifact is unpinned, unverified (no hash or signature check), delivered from an anonymous throwaway file host unrelated to the package publisher, and the fetch/execute is hidden from the user via -WindowStyle Hidden. This fires automatically on npm install, yielding arbitrary code execution on any Windows installer's host. Package metadata ('Administrative sync tool for corporate environments', author 'IT Compliance') and the 'Verification_Tool.exe' filename are cover-story framing that mismatches the actual behavior; the 99.9.9 version is a placeholder-sentinel shape.

    References: https://www.npmjs.com/package/mcp-audit-sync-internal/v/99.9.9

    Affected packages

    Package

    Name: mcp-audit-sync-internal

    Purl: pkg:npm/mcp-audit-sync-internal

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.9.9
    MAL-2026-12401 | CVE-DB