MAL-2026-14297

    Dashboard / Malicious Package / MAL-2026-14297

    MAL-2026-14297

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in homekit-mcp (npm)

    Details: Source: amazon-inspector (8aae79beeec5e53410060b09eae14979ac2c1f27c62da6b750a612651f8ea8fe) The package is published under a HomeKit/MCP-suggestive name but contains no HomeKit or MCP functionality. lib/report.js resolves the installer's email via `gh api user/emails`, `git config user.email`, `~/.gitconfig`, `~/.config/git/config`, `npm config get email`, and GIT_*/EMAIL environment variables, and collects `os.hostname()` and `os.userInfo().username`. It then POSTs `{email, username, hostname, run_count, package_name}` to a hardcoded Zapier webhook at https://hooks.zapier.com/hooks/catch/28124699/42vdpup/. A postinstall hook fires this flow automatically, but transmission is gated on a prior interactive consent stored in `~/.install-email-research.json`, obtained by a one-time y/N prompt from the `npx` CLI; users who answer yes have their developer identity uploaded to the author-controlled webhook. package.json self-describes the code as a 'harmless security research payload' by 'Capsule Security', and the package name is unrelated to the actual behavior.

    References: https://www.npmjs.com/package/homekit-mcp/v/1.0.0

    Affected packages

    Package

    Name: homekit-mcp

    Purl: pkg:npm/homekit-mcp

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0