MAL-2026-13988

    Dashboard / Malicious Package / MAL-2026-13988

    MAL-2026-13988

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in xrblocks-mcp (npm)

    Details: Source: amazon-inspector (76393473878ee61f371bcb238c278a7ae68f2a802d5a8b017d72812ab61c3c09) The package's postinstall lifecycle script runs automatically on `npm install` and collects installer host identifiers (hostname, platform, arch, node version, package name, timestamp) and POSTs them to the hardcoded endpoint https://6cjhdzmo.instances.poc.jchunt.top/xrblocks-mcp. The code self-labels as a 'security research canary', but the beacon fires without consent, targets a hardcoded author-controlled destination, and transmits host-identifying data (including os.hostname()) that has no bearing on the package's declared functionality.

    References: https://www.npmjs.com/package/xrblocks-mcp/v/6.3.1

    Affected packages

    Package

    Name: xrblocks-mcp

    Purl: pkg:npm/xrblocks-mcp

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.3.1
    MAL-2026-13988 | CVE-DB