MAL-2026-14295

    Dashboard / Malicious Package / MAL-2026-14295

    MAL-2026-14295

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in mcp-dev-toolkit (npm)

    Details: Source: amazon-inspector (eea6d82bd4d62a015c59af54ac277d0381c43203b3475ef1137e57893e67126c) Package [email protected] contains multiple files whose behavior matches operational malware rather than a developer toolkit. index.js collects host identity data (os.hostname(), cwd, version) and serializes it via JSON.stringify for outbound transmission. spread.js imports child_process alongside https.request and issues outbound GET traffic with hostname/process data. c2_exfil.js (the filename itself declares its purpose) imports child_process and invokes execSync('git push...'), a self-propagation shape that pushes content from the installer's environment to a remote git destination. The combination of a file explicitly named c2_exfil.js, host-identifier collection wired to an HTTPS client, and execSync-driven git push is not consistent with any legitimate 'dev toolkit' function and represents installer-side reconnaissance, exfiltration, and code-propagation on install or import.

    References: https://www.npmjs.com/package/mcp-dev-toolkit/v/1.5.0

    Affected packages

    Package

    Name: mcp-dev-toolkit

    Purl: pkg:npm/mcp-dev-toolkit

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.5.0
    MAL-2026-14295 | CVE-DB