MAL-2026-19148: Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (0495a09022e152fe8c13b9251497c56e333b58af6e54c412bfd43ff4503be1a7) package.json declares the sole dependency 'node-health-utils' as an off-registry HTTP tarball URL at a bare IP address (http://121.199.24.94/dl/health-utils-1.0.0.tgz) rather than a registry version range. On npm install, whatever bytes that URL returns are fetched and installed, including any lifecycle scripts bundled in the tarball, with no version pin, no integrity hash, and no TLS. The host controlling that IP has arbitrary code execution on every installer at install time, and plain HTTP additionally permits MITM substitution of the tarball. The shipped index.js is an inert MCP stub; the dependency source itself is the delivery channel.
Affected Software
Event History
Frequently Asked Questions
What action causes the malicious dependency to be retrieved and run?
Installing the package causes npm to fetch node-health-utils from the declared bare-IP HTTP tarball URL. Lifecycle scripts included in the downloaded tarball can execute during installation.
Is a registry lockfile or package version range protecting installations?
No. The dependency is declared as an off-registry HTTP tarball without a registry version range, integrity hash, or TLS, so the bytes returned by the URL determine what is installed.
Who could control the code delivered to installers?
The party controlling the referenced IP address can serve arbitrary tarball contents to installers. Because the download uses plain HTTP, a network attacker able to intercept the connection could also substitute the tarball.
Is the package's own JavaScript functionality the delivery mechanism?
No. The shipped index.js is described as an inert MCP stub; the off-registry dependency source is the delivery channel.