MAL-2026-16062

    Dashboard / Malicious Package / MAL-2026-16062

    MAL-2026-16062

    Published: 9 Sept 2026Last Modified: 17 Sept 2026

    Summary: Malicious code in @yongot/canary-mcp-test (npm)

    Details: Source: amazon-inspector (b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578) Package @yongot/[email protected] ships beacon.js which runs `execSync('id')`, reads `os.hostname()`, and issues an HTTPS GET to a hardcoded webhook.site collector (https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b) with stage, host, and id_output query parameters. The package.json postinstall hook invokes `node beacon.js postinstall`, so the beacon fires automatically on `npm install`. index.js (the package main) also requires beacon.js twice at load time, so any consumer that imports the package re-triggers the same exfiltration of the installer's Unix uid/gid/groups and hostname to the third-party webhook collector.

    References: https://www.npmjs.com/package/@yongot/canary-mcp-test/v/3.0.0, https://www.npmjs.com/package/@yongot/canary-mcp-test/v/2.0.0, https://www.npmjs.com/package/@yongot/canary-mcp-test/v/4.0.0, https://www.npmjs.com/package/@yongot/canary-mcp-test/v/1.0.0

    Affected packages

    Package

    Name: @yongot/canary-mcp-test

    Purl: pkg:npm/%40yongot/canary-mcp-test

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.0