Malicious code in mcp-server-sequential-thinking (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (211672c16839ae6cd4e9f10810163da536480f07938b2d51c50ecbbb9f5e90ed) Unscoped package impersonating the official @modelcontextprotocol/server-sequential-thinking MCP server. package.json declares postinstall: 'node index.js' and a bin entry mapping mcp-server-sequential-thinking to./index.js, so both `npm install` and `npx mcp-server-sequential-thinking` execute index.js automatically. index.js requires os/https/http and at lines 17-28 unconditionally POSTs a JSON payload containing os.hostname(), process.cwd(), the npm user-agent, Node version, and os.platform()/arch to https://npx-canary-log.vulnerable-live.workers.dev/log, a Cloudflare Workers endpoint controlled by the package author. The payload includes a `trigger` field that distinguishes postinstall vs bin-exec invocations, confirming the author intends to harvest both pathways. The package targets AI coding agents and developers who type the unscoped name expecting the official scoped MCP server. Although the README frames this as 'canary' research, installers do not consent, and host identifiers leave the machine to an attacker-controlled destination at install time. ## Source: ghsa-malware (3ee441aba0778c86ceda85fd4fb9fd3f5df27e8bd5aa75d393d5c3377e9f5525) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a
MAL-2026-5484
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-5484
mcp-server-sequential-thinking
Source reference: /affected/0/package/name
- Affected versions
- 0.0.1
Source reference:
/affected/0/versions0.0.2Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "mcp-server-sequential-thinking",
"purl": "pkg:npm/mcp-server-sequential-thinking",
"ecosystem": "npm"
},
"versions": [
"0.0.1",
"0.0.2"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mcp-server-sequential-thinking/MAL-2026-5484.json",
"indicators": {
"domains": [
"npx-canary-log.vulnerable-live.workers.dev"
],
"evidence_files": [
{
"path": "index.js",
"tlsh": "c83198d180f805351bfe46d3e1e9a859a36ff1363a0678f0b45d01591fcd4980771cd1",
"sha256": "b8079eafb4b163288f370094b02d8420cfe69e12ed08e0d8dc31c66f83941f35"
},
{
"path": "package.json",
"tlsh": "16f00e20d8f0a4330afe86a51876b444f17dab665780bc2853d7201dca4c9bb07bf29c",
"sha256": "66e204e5409da309d0f1c0b4eac2f3f2ecef4df72befe42cc03bc20efe762e40"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "575bafb74c14226bf0f19764bb4d4e4729eb1b03",
"sha512_sri": "sha512-pHvlcZdLzRFxxctvdZOpLfK2jme+U9jfy30SLLJHtRpBJwZ6WZtAStOkfEMSZqT9OBNWPdRmx4Cv0oJTW+vXqg=="
},
"filename": "mcp-server-sequential-thinking-0.0.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #6190 · Revision 1
- Added to Heist Feed
- Publisher date