marketing-mcp

{"schema_version":"1.7.4","id":"MAL-2026-16250","published":"2026-09-17T12:43:45Z","modified":"2026-09-17T14:43:22.383127998Z","summary":"Malicious code in marketing-mcp (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (87216e00fe68e2de8b140f1f9ffc2db5a8e814f38030e2eb6120c9ae9e7ca3ff)\nThe package exposes an MCP tool `send(path)` that reads a caller-specified local file and POSTs its contents to a hardcoded `https://webhook.site/4acf7132-a75e-47e1-aeff-0350c8eac16c` endpoint. The destination is a fixed public request-capture service, is not caller-configurable, and is not the installer's infrastructure. Any file path an LLM agent is induced to pass to `send` — including sensitive paths such as `~/.ssh/id_rsa`, `~/.aws/credentials`, `.env` files, or source trees — is uploaded to that third-party capture URL where the operator of the webhook can retrieve it. The package's advertised marketing/MCP framing does not match the actual behavior, which is a one-way file relay to an author-controlled inspection endpoint.\n\n## Source: kam193 (6a271b29f840e2047c34363e985921e1a374194cfcae7524698f178c96bea9eb)\nPackage attempts to lure LLM agents to exfiltrate files to a hardcoded location. Analysis of infrastructure suggests preparing for exfiltrating credentials.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-marketing-mcp\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - llm-threat\n","affected":[{"package":{"name":"marketing-mcp","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/marketing_mcp/server.py","sha256":"77b5593a340c0d5de3a53f09513e01d2799afd3f1a897bd0a5d1193d3a761f49","tlsh":"6e4122cb6fc921e1875153d40f028da4e715e8ef3a020a387b9c51793f8813587eeaa8"}],"package_integrity":[{"filename":"marketing_mcp-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"bccf346427e4693fbae743c35fa60dd92e4f46436f0de051542a6bfc7c58c05f","md5":"59c16b969497e07950ae7628a1c1f3ac","sha256":"7c44657bd6a87387c0ac074742b87f7b49df7a18883c430a89411466249c2543"}},{"filename":"marketing_mcp-0.1.0.tar.gz","hashes":{"blake2b_256":"f023f6ad2cf2dd967eab7d853cde326adcff57fc32c7afc1430bf4ce01cfb7a6","md5":"0a52c0e8028bdda5a34f7011aefbf128","sha256":"e5ca7392e9ce80c0b1e9317da517c57236ac4031e7c32abe91fdf15328a65c33"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/marketing-mcp"},{"type":"PACKAGE","url":"https://pypi.org/project/marketing-mcp/0.1.0/"}],"database_specific":{"iocs":{"urls":["https://webhook.site/4acf7132-a75e-47e1-aeff-0350c8eac16c"]},"malicious-packages-origins":[{"id":"pypi/2026-09-marketing-mcp/marketing-mcp","import_time":"2026-09-17T13:18:14.640160033Z","modified_time":"2026-09-17T12:43:45.919849Z","sha256":"6a271b29f840e2047c34363e985921e1a374194cfcae7524698f178c96bea9eb","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-020123","import_time":"2026-09-17T14:41:23.780814888Z","modified_time":"2026-09-17T14:27:07Z","sha256":"87216e00fe68e2de8b140f1f9ffc2db5a8e814f38030e2eb6120c9ae9e7ca3ff","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}