{
 "updated": "2026-10-19",
 "source_note": "Every entry is a package that GitHub's reviewed malware advisories (github.com/advisories, type malware) and/or OSV malicious-package (MAL) records flag as malicious, and that copies the name of a popular MCP server or agent tool. Each entry was checked against those advisories by a second reviewer before publishing. We did not install, download or run any of these packages. Endpoint and beacon domains are left out or defanged on purpose. Never install these; install the official package named in 'imitates' instead.",
 "count": 33,
 "page": "https://agenttested.dev/malware",
 "packages": [
  {
   "package": "@chatclub/claude-code",
   "ecosystem": "npm",
   "imitates": "@anthropic-ai/claude-code",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name; exists on npm",
   "advisories": [
    {
     "id": "GHSA-w7jq-xv2w-v96w",
     "url": "https://github.com/advisories/GHSA-w7jq-xv2w-v96w"
    },
    {
     "id": "MAL-2025-49379",
     "url": "https://osv.dev/vulnerability/MAL-2025-49379"
    }
   ],
   "reason": "Amazon Inspector: contains malicious code; GitHub generic malware notice ('consider the machine fully compromised; rotate secrets')."
  },
  {
   "package": "@httttt/mcp-npx-fetch-1",
   "ecosystem": "npm",
   "imitates": "mcp-server-fetch (PyPI Fetch MCP server)",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name, weak",
   "advisories": [
    {
     "id": "GHSA-q6m6-3rfx-7f62",
     "url": "https://github.com/advisories/GHSA-q6m6-3rfx-7f62"
    },
    {
     "id": "MAL-2026-16422",
     "url": "https://osv.dev/vulnerability/MAL-2026-16422"
    }
   ],
   "reason": "Only the GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); no behaviour detail. Its imitation target is a weak, name-only inference."
  },
  {
   "package": "anthropic-claude-latest",
   "ecosystem": "npm",
   "imitates": "@anthropic-ai/sdk",
   "imitates_inferred": false,
   "imitates_basis": "advisory: claims to be an 'Official Anthropic Claude SDK wrapper'",
   "advisories": [
    {
     "id": "GHSA-j588-p757-86r9",
     "url": "https://github.com/advisories/GHSA-j588-p757-86r9"
    },
    {
     "id": "MAL-2026-6415",
     "url": "https://osv.dev/vulnerability/MAL-2026-6415"
    }
   ],
   "reason": "Amazon Inspector: claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic code. A _warmup routine in the exported CacheSync/createCache contacts a remote host. Also carries the GitHub generic compromise notice."
  },
  {
   "package": "anthropic-sdk",
   "ecosystem": "npm",
   "imitates": "@anthropic-ai/sdk",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name; exists on npm",
   "advisories": [
    {
     "id": "GHSA-j8wc-8p9m-6fm6",
     "url": "https://github.com/advisories/GHSA-j8wc-8p9m-6fm6"
    },
    {
     "id": "MAL-2026-405",
     "url": "https://osv.dev/vulnerability/MAL-2026-405"
    }
   ],
   "reason": "Amazon Inspector: contains malicious code; GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); no behaviour detail."
  },
  {
   "package": "auth0-mcp-server",
   "ecosystem": "npm",
   "imitates": "@auth0/auth0-mcp-server",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name; exists on npm",
   "advisories": [
    {
     "id": "GHSA-hfw5-55r9-cx88",
     "url": "https://github.com/advisories/GHSA-hfw5-55r9-cx88"
    },
    {
     "id": "MAL-2025-15093",
     "url": "https://osv.dev/vulnerability/MAL-2025-15093"
    }
   ],
   "reason": "'Found to contain malicious code' (OpenSSF credit) plus the GitHub generic compromise notice; no behaviour detail."
  },
  {
   "package": "brave-search-mcp-server",
   "ecosystem": "npm",
   "imitates": "@brave/brave-search-mcp-server",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name; exists on npm",
   "advisories": [
    {
     "id": "GHSA-56pv-xqqh-57cf",
     "url": "https://github.com/advisories/GHSA-56pv-xqqh-57cf"
    },
    {
     "id": "MAL-2026-5182",
     "url": "https://osv.dev/vulnerability/MAL-2026-5182"
    }
   ],
   "reason": "OpenSSF Package Analysis flagged 1.0.0: it contacts a domain associated with malicious activity and runs commands associated with malicious behaviour."
  },
  {
   "package": "claude-code-base-action",
   "ecosystem": "npm",
   "imitates": "anthropics/claude-code-base-action (GitHub Action, not an npm package)",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name",
   "advisories": [
    {
     "id": "GHSA-3x98-842h-2764",
     "url": "https://github.com/advisories/GHSA-3x98-842h-2764"
    },
    {
     "id": "MAL-2026-3811",
     "url": "https://osv.dev/vulnerability/MAL-2026-3811"
    }
   ],
   "reason": "Amazon Inspector: contains malicious code; OpenSSF Package Analysis flagged 2.0.0 as malicious."
  },
  {
   "package": "claude-pr-action",
   "ecosystem": "npm",
   "imitates": "anthropics/claude-code-action (GitHub Action)",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name",
   "advisories": [
    {
     "id": "GHSA-jmg8-82j4-hrp6",
     "url": "https://github.com/advisories/GHSA-jmg8-82j4-hrp6"
    },
    {
     "id": "MAL-2025-4668",
     "url": "https://osv.dev/vulnerability/MAL-2025-4668"
    }
   ],
   "reason": "GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 0.0.1 as malicious."
  },
  {
   "package": "cursor-ai-fork",
   "ecosystem": "npm",
   "imitates": "Cursor AI editor (not an npm package)",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name",
   "advisories": [
    {
     "id": "GHSA-wrwh-678j-xg4q",
     "url": "https://github.com/advisories/GHSA-wrwh-678j-xg4q"
    },
    {
     "id": "MAL-2025-49254",
     "url": "https://osv.dev/vulnerability/MAL-2025-49254"
    }
   ],
   "reason": "Amazon Inspector: contains malicious code; GitHub generic malware notice ('consider the machine fully compromised; rotate secrets')."
  },
  {
   "package": "glean-mcp-server",
   "ecosystem": "npm",
   "imitates": "@gleanwork/mcp-server",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name; exists on npm",
   "advisories": [
    {
     "id": "GHSA-94vh-73p7-p3wc",
     "url": "https://github.com/advisories/GHSA-94vh-73p7-p3wc"
    },
    {
     "id": "MAL-2025-5813",
     "url": "https://osv.dev/vulnerability/MAL-2025-5813"
    }
   ],
   "reason": "GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); no behaviour detail."
  },
  {
   "package": "mcp-server-everything",
   "ecosystem": "npm",
   "imitates": "@modelcontextprotocol/server-everything",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name; exists on npm",
   "advisories": [
    {
     "id": "GHSA-6j44-frpv-rvv9",
     "url": "https://github.com/advisories/GHSA-6j44-frpv-rvv9"
    },
    {
     "id": "MAL-2025-46986",
     "url": "https://osv.dev/vulnerability/MAL-2025-46986"
    }
   ],
   "reason": "GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 2.0.0 as malicious."
  },
  {
   "package": "mcp-server-fetch",
   "ecosystem": "npm",
   "imitates": "mcp-server-fetch (PyPI, official Fetch MCP server)",
   "imitates_inferred": false,
   "imitates_basis": "named in advisory; exists on PyPI",
   "advisories": [
    {
     "id": "GHSA-88f3-qjxp-rpp3",
     "url": "https://github.com/advisories/GHSA-88f3-qjxp-rpp3"
    },
    {
     "id": "GHSA-rh9p-4pg3-8628",
     "url": "https://github.com/advisories/GHSA-rh9p-4pg3-8628"
    },
    {
     "id": "MAL-2026-5476",
     "url": "https://osv.dev/vulnerability/MAL-2026-5476"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "mcp-server-figma",
   "ecosystem": "npm",
   "imitates": "Figma MCP server (official scoped package; advisory does not name it)",
   "imitates_inferred": true,
   "imitates_basis": "advisory wording",
   "advisories": [
    {
     "id": "GHSA-8j33-qh42-vjc6",
     "url": "https://github.com/advisories/GHSA-8j33-qh42-vjc6"
    },
    {
     "id": "GHSA-cxx6-mmxm-vfm4",
     "url": "https://github.com/advisories/GHSA-cxx6-mmxm-vfm4"
    },
    {
     "id": "MAL-2026-5477",
     "url": "https://osv.dev/vulnerability/MAL-2026-5477"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "mcp-server-git",
   "ecosystem": "npm",
   "imitates": "mcp-server-git (PyPI, modelcontextprotocol/servers)",
   "imitates_inferred": false,
   "imitates_basis": "advisory: 'officially distributed under a different name'; PyPI mcp-server-git exists",
   "advisories": [
    {
     "id": "GHSA-hmxw-q2gh-p268",
     "url": "https://github.com/advisories/GHSA-hmxw-q2gh-p268"
    },
    {
     "id": "GHSA-prf3-6rx4-9h5f",
     "url": "https://github.com/advisories/GHSA-prf3-6rx4-9h5f"
    },
    {
     "id": "MAL-2026-5478",
     "url": "https://osv.dev/vulnerability/MAL-2026-5478"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "mcp-server-github",
   "ecosystem": "npm",
   "imitates": "@modelcontextprotocol/server-github",
   "imitates_inferred": false,
   "imitates_basis": "named in advisory; exists on npm",
   "advisories": [
    {
     "id": "GHSA-95pj-hrh5-27gq",
     "url": "https://github.com/advisories/GHSA-95pj-hrh5-27gq"
    },
    {
     "id": "GHSA-mmcr-x94x-c3mp",
     "url": "https://github.com/advisories/GHSA-mmcr-x94x-c3mp"
    },
    {
     "id": "MAL-2026-5479",
     "url": "https://osv.dev/vulnerability/MAL-2026-5479"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "mcp-server-notion",
   "ecosystem": "npm",
   "imitates": "@notionhq/notion-mcp-server",
   "imitates_inferred": true,
   "imitates_basis": "advisory says 'scoped MCP Notion server'; scoped name inferred, exists on npm",
   "advisories": [
    {
     "id": "GHSA-56wr-9mvj-77pf",
     "url": "https://github.com/advisories/GHSA-56wr-9mvj-77pf"
    },
    {
     "id": "GHSA-mx42-9xv4-vm87",
     "url": "https://github.com/advisories/GHSA-mx42-9xv4-vm87"
    },
    {
     "id": "MAL-2026-5480",
     "url": "https://osv.dev/vulnerability/MAL-2026-5480"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "mcp-server-postgres",
   "ecosystem": "npm",
   "imitates": "@modelcontextprotocol/server-postgres",
   "imitates_inferred": false,
   "imitates_basis": "advisory: 'official scoped MCP postgres server'; exists on npm",
   "advisories": [
    {
     "id": "GHSA-62p7-frf5-h7p2",
     "url": "https://github.com/advisories/GHSA-62p7-frf5-h7p2"
    },
    {
     "id": "GHSA-vm2g-qj5x-x234",
     "url": "https://github.com/advisories/GHSA-vm2g-qj5x-x234"
    },
    {
     "id": "MAL-2026-5481",
     "url": "https://osv.dev/vulnerability/MAL-2026-5481"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "mcp-server-redis",
   "ecosystem": "npm",
   "imitates": "@modelcontextprotocol/server-redis",
   "imitates_inferred": true,
   "imitates_basis": "advisory: 'legitimate MCP Redis server'; scoped name inferred, exists on npm",
   "advisories": [
    {
     "id": "GHSA-2rvc-xw64-r74h",
     "url": "https://github.com/advisories/GHSA-2rvc-xw64-r74h"
    },
    {
     "id": "GHSA-wrqr-prmr-6x32",
     "url": "https://github.com/advisories/GHSA-wrqr-prmr-6x32"
    },
    {
     "id": "MAL-2026-5482",
     "url": "https://osv.dev/vulnerability/MAL-2026-5482"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "mcp-server-sentry",
   "ecosystem": "npm",
   "imitates": "@sentry/mcp-server",
   "imitates_inferred": true,
   "imitates_basis": "advisory: 'official MCP Sentry server'; scoped name inferred, exists on npm",
   "advisories": [
    {
     "id": "GHSA-28qv-2m9q-wm2p",
     "url": "https://github.com/advisories/GHSA-28qv-2m9q-wm2p"
    },
    {
     "id": "GHSA-m5mm-f722-7vcq",
     "url": "https://github.com/advisories/GHSA-m5mm-f722-7vcq"
    },
    {
     "id": "MAL-2026-5483",
     "url": "https://osv.dev/vulnerability/MAL-2026-5483"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "mcp-server-sequential-thinking",
   "ecosystem": "npm",
   "imitates": "@modelcontextprotocol/server-sequential-thinking",
   "imitates_inferred": false,
   "imitates_basis": "named in advisory; exists on npm",
   "advisories": [
    {
     "id": "GHSA-hrmj-jj6j-m2m2",
     "url": "https://github.com/advisories/GHSA-hrmj-jj6j-m2m2"
    },
    {
     "id": "GHSA-w69h-vf37-j4w6",
     "url": "https://github.com/advisories/GHSA-w69h-vf37-j4w6"
    },
    {
     "id": "MAL-2026-5484",
     "url": "https://osv.dev/vulnerability/MAL-2026-5484"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "mcp-server-supabase",
   "ecosystem": "npm",
   "imitates": "@supabase/mcp-server-supabase",
   "imitates_inferred": false,
   "imitates_basis": "advisory: 'official scoped Supabase MCP server'; exists on npm",
   "advisories": [
    {
     "id": "GHSA-48pr-c89h-69q7",
     "url": "https://github.com/advisories/GHSA-48pr-c89h-69q7"
    },
    {
     "id": "GHSA-m633-5vq7-98qx",
     "url": "https://github.com/advisories/GHSA-m633-5vq7-98qx"
    },
    {
     "id": "MAL-2026-5485",
     "url": "https://osv.dev/vulnerability/MAL-2026-5485"
    }
   ],
   "reason": "Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent)."
  },
  {
   "package": "playwright-1.45",
   "ecosystem": "npm",
   "imitates": "playwright (v1.45)",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name",
   "advisories": [
    {
     "id": "GHSA-837v-p99r-7m63",
     "url": "https://github.com/advisories/GHSA-837v-p99r-7m63"
    },
    {
     "id": "MAL-2024-11772",
     "url": "https://osv.dev/vulnerability/MAL-2024-11772"
    }
   ],
   "reason": "GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 10.1.3 as malicious."
  },
  {
   "package": "playwright-1.46",
   "ecosystem": "npm",
   "imitates": "playwright (v1.46)",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name",
   "advisories": [
    {
     "id": "GHSA-wq42-hwhv-vfph",
     "url": "https://github.com/advisories/GHSA-wq42-hwhv-vfph"
    },
    {
     "id": "MAL-2024-11773",
     "url": "https://osv.dev/vulnerability/MAL-2024-11773"
    }
   ],
   "reason": "GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 7.2.7 as malicious."
  },
  {
   "package": "playwright-1.47",
   "ecosystem": "npm",
   "imitates": "playwright (v1.47)",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name",
   "advisories": [
    {
     "id": "GHSA-3367-69g6-4f4x",
     "url": "https://github.com/advisories/GHSA-3367-69g6-4f4x"
    },
    {
     "id": "MAL-2024-11774",
     "url": "https://osv.dev/vulnerability/MAL-2024-11774"
    }
   ],
   "reason": "GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 10.1.8 as malicious."
  },
  {
   "package": "playwright-1.48",
   "ecosystem": "npm",
   "imitates": "playwright (v1.48)",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name",
   "advisories": [
    {
     "id": "GHSA-xqw4-v3qp-jhf3",
     "url": "https://github.com/advisories/GHSA-xqw4-v3qp-jhf3"
    },
    {
     "id": "MAL-2024-12021",
     "url": "https://osv.dev/vulnerability/MAL-2024-12021"
    }
   ],
   "reason": "Only the GitHub generic malware notice ('consider the machine fully compromised; rotate secrets')."
  },
  {
   "package": "playwright-internal",
   "ecosystem": "npm",
   "imitates": "playwright",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name; exists on npm",
   "advisories": [
    {
     "id": "GHSA-rvcc-7jx6-qqh4",
     "url": "https://github.com/advisories/GHSA-rvcc-7jx6-qqh4"
    },
    {
     "id": "MAL-2023-8277",
     "url": "https://osv.dev/vulnerability/MAL-2023-8277"
    }
   ],
   "reason": "Only the GitHub generic malware notice ('consider the machine fully compromised; rotate secrets')."
  },
  {
   "package": "playwright.dev",
   "ecosystem": "npm",
   "imitates": "playwright",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name",
   "advisories": [
    {
     "id": "GHSA-g96r-8j88-jrv4",
     "url": "https://github.com/advisories/GHSA-g96r-8j88-jrv4"
    },
    {
     "id": "MAL-2022-5360",
     "url": "https://osv.dev/vulnerability/MAL-2022-5360"
    }
   ],
   "reason": "Only the GitHub generic malware notice ('consider the machine fully compromised; rotate secrets')."
  },
  {
   "package": "vscode-azure-mcp-server",
   "ecosystem": "npm",
   "imitates": "@azure/mcp (Azure MCP Server)",
   "imitates_inferred": true,
   "imitates_basis": "inferred from name; exists on npm",
   "advisories": [
    {
     "id": "GHSA-g3xg-r65r-rjp9",
     "url": "https://github.com/advisories/GHSA-g3xg-r65r-rjp9"
    },
    {
     "id": "MAL-2025-192601",
     "url": "https://osv.dev/vulnerability/MAL-2025-192601"
    }
   ],
   "reason": "Amazon Inspector: contains malicious code; OpenSSF Package Analysis flagged 1.0.0; GitHub generic malware notice ('consider the machine fully compromised; rotate secrets')."
  },
  {
   "package": "anthropic-sdk",
   "ecosystem": "PyPI",
   "imitates": "anthropic (PyPI)",
   "imitates_inferred": false,
   "imitates_basis": "advisory: re-exports official anthropic symbols; exists on PyPI",
   "advisories": [
    {
     "id": "GHSA-xxp4-7566-29xj",
     "url": "https://github.com/advisories/GHSA-xxp4-7566-29xj"
    },
    {
     "id": "MAL-2026-17472",
     "url": "https://osv.dev/vulnerability/MAL-2026-17472"
    }
   ],
   "reason": "Re-exports the official anthropic symbols as a drop-in. On import it fetches a remote script, fingerprints for sandboxes, then exfiltrates credentials, env vars, AI chat files and SSH keys (kam193 category MALICIOUS; Amazon Inspector)."
  },
  {
   "package": "instructor-mcp",
   "ecosystem": "PyPI",
   "imitates": "instructor (PyPI)",
   "imitates_inferred": false,
   "imitates_basis": "named in advisory",
   "advisories": [
    {
     "id": "GHSA-vp83-46ch-mpvw",
     "url": "https://github.com/advisories/GHSA-vp83-46ch-mpvw"
    },
    {
     "id": "MAL-2026-5317",
     "url": "https://osv.dev/vulnerability/MAL-2026-5317"
    },
    {
     "id": "PYSEC-2026-1069",
     "url": "https://osv.dev/vulnerability/PYSEC-2026-1069"
    }
   ],
   "reason": "Typosquat copying instructor's authors, README and repo URL. instructor-setup.pth runs a Bun-based infostealer on every Python start (Shai-Hulud 'Hades' wave)."
  },
  {
   "package": "langchain-core-mcp",
   "ecosystem": "PyPI",
   "imitates": "langchain-core (PyPI)",
   "imitates_inferred": false,
   "imitates_basis": "named in advisory",
   "advisories": [
    {
     "id": "GHSA-f6f5-m9qw-v738",
     "url": "https://github.com/advisories/GHSA-f6f5-m9qw-v738"
    },
    {
     "id": "MAL-2026-5318",
     "url": "https://osv.dev/vulnerability/MAL-2026-5318"
    },
    {
     "id": "PYSEC-2026-1070",
     "url": "https://osv.dev/vulnerability/PYSEC-2026-1070"
    }
   ],
   "reason": "Copies langchain-core's metadata and README, and drops .pth files that run an obfuscated Bun-based infostealer on every Python start (Shai-Hulud 'Hades' wave)."
  },
  {
   "package": "openai-mcp",
   "ecosystem": "PyPI",
   "imitates": "openai (PyPI)",
   "imitates_inferred": false,
   "imitates_basis": "named in advisory",
   "advisories": [
    {
     "id": "GHSA-h7rx-63j6-3w83",
     "url": "https://github.com/advisories/GHSA-h7rx-63j6-3w83"
    },
    {
     "id": "MAL-2026-5320",
     "url": "https://osv.dev/vulnerability/MAL-2026-5320"
    },
    {
     "id": "PYSEC-2026-1072",
     "url": "https://osv.dev/vulnerability/PYSEC-2026-1072"
    }
   ],
   "reason": "Impersonates the openai SDK. openai-setup.pth runs on every Python start and launches an obfuscated JS infostealer via Bun that harvests API keys and credentials (Shai-Hulud 'Hades' wave, published from a compromised account)."
  },
  {
   "package": "tiktoken-mcp",
   "ecosystem": "PyPI",
   "imitates": "tiktoken (PyPI)",
   "imitates_inferred": false,
   "imitates_basis": "named in advisory",
   "advisories": [
    {
     "id": "GHSA-wj5q-fgqm-2wv6",
     "url": "https://github.com/advisories/GHSA-wj5q-fgqm-2wv6"
    },
    {
     "id": "MAL-2026-5326",
     "url": "https://osv.dev/vulnerability/MAL-2026-5326"
    },
    {
     "id": "PYSEC-2026-1075",
     "url": "https://osv.dev/vulnerability/PYSEC-2026-1075"
    }
   ],
   "reason": "Copies tiktoken's metadata (author Shantanu Jain, openai repo URL). tiktoken-setup.pth runs a Bun-based infostealer on every Python start (Shai-Hulud 'Hades' wave)."
  }
 ]
}