broadcast-graphics-mcp

{"modified":"2026-08-19T03:41:11Z","published":"2026-08-19T03:41:11Z","schema_version":"1.7.4","id":"MAL-2026-14228","summary":"Malicious code in broadcast-graphics-mcp (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (48987a1a0ccff7dce1134e1a98122cd902961ac34ba623ae0e2fef62f75fe213)\nThe package's postinstall script runs automatically on `npm install` and collects host identifiers from the installer machine (os.hostname(), platform, arch, node version, package name, npm lifecycle event, timestamp), then POSTs them as JSON to the hardcoded host `2obx43du.instances.poc.jchunt.top` at path `/broadcast-graphics-mcp`. The destination is not a first-party or user-configurable endpoint; installation of the package unconditionally leaks installer-side identity data to a remote party. The package self-labels as a 'security research canary', but self-labeling does not change the behavior: installing this package causes install-time exfiltration of host metadata to an author-controlled endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"broadcast-graphics-mcp"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"6ff0391e7ffbc5c38047d00dc82b34f4afbed82d54322f6735391ed2dbb18ca9","tlsh":"ce01fed1d2b55a316bb8a28068e0ae0793faf223370660b679c404e92f8d2f900311ac"}],"package_integrity":[{"filename":"broadcast-graphics-mcp-1.0.0.tgz","hashes":{"sha1":"f68126e7db311e248e3df7368fb92ddb9ea55440","sha512_sri":"sha512-Ybh6iju9kCPdzDZB4r3hAXnMcRcgBT7r/wCi9K1xQirngA6HTesKGL5XqngmpV2NYMmfRyD2cjOOj/2W8bWu2g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/broadcast-graphics-mcp/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018328","import_time":"2026-08-19T03:49:30.557897707Z","modified_time":"2026-08-19T03:41:11Z","sha256":"48987a1a0ccff7dce1134e1a98122cd902961ac34ba623ae0e2fef62f75fe213","source":"amazon-inspector","versions":["1.0.0"]}]}}