MAL-2026-12789

    Dashboard / Malicious Package / MAL-2026-12789

    MAL-2026-12789

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in fa-mcp-sdk (npm)

    Details: Source: amazon-inspector (62142cbcb6da6a6c078dd91a92cc28d8cfa30a9f4fc901ab2cdbc4cfd6540abb) The package includes cli-template/update.cjs, an update helper that combines several install/update-time capabilities: it imports child_process, https, fs, and os; reads os.hostname() and other system identifiers; issues https.request POST calls to a remote endpoint; performs filesystem existence checks; and calls spawn('/bin/bash',...) to execute shell commands. The composition — host identifier collection, arbitrary shell execution via /bin/bash, and outbound HTTPS POST inside a self-updater — provides a mechanism to run remote-directed commands on machines that install or run this package. Additional files under dist/core/ (agent-tester/services/TesterMcpClientService.js, web/server-http.js) exercise ping/HTTP GET/POST patterns consistent with host reachability probing and outbound command/data flow.

    References: https://www.npmjs.com/package/fa-mcp-sdk/v/0.12.72

    Affected packages

    Package

    Name: fa-mcp-sdk

    Purl: pkg:npm/fa-mcp-sdk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.12.72
    MAL-2026-12789 | CVE-DB