Known malware look-alikes: malicious npm and PyPI packages that copy MCP server and agent tool names
33 packages (28 npm, 5 PyPI). Last updated . Agents: the same list as JSON at /api/malware.json (how to check a name: /agents#malware).
| Package | Ecosystem | Real package it imitates | Advisories | Why it is listed |
|---|---|---|---|---|
@chatclub/claude-code | npm | @anthropic-ai/claude-code inferred Not named in the advisory; inferred: inferred from name; exists on npm | GHSA-w7jq-xv2w-v96w MAL-2025-49379 | Amazon Inspector: contains malicious code; GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'). |
@httttt/mcp-npx-fetch-1 | npm | mcp-server-fetch (PyPI Fetch MCP server) inferred Not named in the advisory; inferred: inferred from name, weak | GHSA-q6m6-3rfx-7f62 MAL-2026-16422 | Only the GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); no behaviour detail. Its imitation target is a weak, name-only inference. |
anthropic-claude-latest | npm | @anthropic-ai/sdk Basis: advisory: claims to be an 'Official Anthropic Claude SDK wrapper' | GHSA-j588-p757-86r9 MAL-2026-6415 | Amazon Inspector: claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic code. A _warmup routine in the exported CacheSync/createCache contacts a remote host. Also carries the GitHub generic compromise notice. |
anthropic-sdk | npm | @anthropic-ai/sdk inferred Not named in the advisory; inferred: inferred from name; exists on npm | GHSA-j8wc-8p9m-6fm6 MAL-2026-405 | Amazon Inspector: contains malicious code; GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); no behaviour detail. |
auth0-mcp-server | npm | @auth0/auth0-mcp-server inferred Not named in the advisory; inferred: inferred from name; exists on npm | GHSA-hfw5-55r9-cx88 MAL-2025-15093 | 'Found to contain malicious code' (OpenSSF credit) plus the GitHub generic compromise notice; no behaviour detail. |
brave-search-mcp-server | npm | @brave/brave-search-mcp-server inferred Not named in the advisory; inferred: inferred from name; exists on npm | GHSA-56pv-xqqh-57cf MAL-2026-5182 | OpenSSF Package Analysis flagged 1.0.0: it contacts a domain associated with malicious activity and runs commands associated with malicious behaviour. |
claude-code-base-action | npm | anthropics/claude-code-base-action (GitHub Action, not an npm package) inferred Not named in the advisory; inferred: inferred from name | GHSA-3x98-842h-2764 MAL-2026-3811 | Amazon Inspector: contains malicious code; OpenSSF Package Analysis flagged 2.0.0 as malicious. |
claude-pr-action | npm | anthropics/claude-code-action (GitHub Action) inferred Not named in the advisory; inferred: inferred from name | GHSA-jmg8-82j4-hrp6 MAL-2025-4668 | GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 0.0.1 as malicious. |
cursor-ai-fork | npm | Cursor AI editor (not an npm package) inferred Not named in the advisory; inferred: inferred from name | GHSA-wrwh-678j-xg4q MAL-2025-49254 | Amazon Inspector: contains malicious code; GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'). |
glean-mcp-server | npm | @gleanwork/mcp-server inferred Not named in the advisory; inferred: inferred from name; exists on npm | GHSA-94vh-73p7-p3wc MAL-2025-5813 | GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); no behaviour detail. |
mcp-server-everything | npm | @modelcontextprotocol/server-everything inferred Not named in the advisory; inferred: inferred from name; exists on npm | GHSA-6j44-frpv-rvv9 MAL-2025-46986 | GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 2.0.0 as malicious. |
mcp-server-fetch | npm | mcp-server-fetch (PyPI, official Fetch MCP server) Basis: named in advisory; exists on PyPI | GHSA-88f3-qjxp-rpp3 GHSA-rh9p-4pg3-8628 MAL-2026-5476 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
mcp-server-figma | npm | Figma MCP server (official scoped package; advisory does not name it) inferred Not named in the advisory; inferred: advisory wording | GHSA-8j33-qh42-vjc6 GHSA-cxx6-mmxm-vfm4 MAL-2026-5477 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
mcp-server-git | npm | mcp-server-git (PyPI, modelcontextprotocol/servers) Basis: advisory: 'officially distributed under a different name'; PyPI mcp-server-git exists | GHSA-hmxw-q2gh-p268 GHSA-prf3-6rx4-9h5f MAL-2026-5478 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
mcp-server-github | npm | @modelcontextprotocol/server-github Basis: named in advisory; exists on npm | GHSA-95pj-hrh5-27gq GHSA-mmcr-x94x-c3mp MAL-2026-5479 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
mcp-server-notion | npm | @notionhq/notion-mcp-server inferred Not named in the advisory; inferred: advisory says 'scoped MCP Notion server'; scoped name inferred, exists on npm | GHSA-56wr-9mvj-77pf GHSA-mx42-9xv4-vm87 MAL-2026-5480 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
mcp-server-postgres | npm | @modelcontextprotocol/server-postgres Basis: advisory: 'official scoped MCP postgres server'; exists on npm | GHSA-62p7-frf5-h7p2 GHSA-vm2g-qj5x-x234 MAL-2026-5481 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
mcp-server-redis | npm | @modelcontextprotocol/server-redis inferred Not named in the advisory; inferred: advisory: 'legitimate MCP Redis server'; scoped name inferred, exists on npm | GHSA-2rvc-xw64-r74h GHSA-wrqr-prmr-6x32 MAL-2026-5482 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
mcp-server-sentry | npm | @sentry/mcp-server inferred Not named in the advisory; inferred: advisory: 'official MCP Sentry server'; scoped name inferred, exists on npm | GHSA-28qv-2m9q-wm2p GHSA-m5mm-f722-7vcq MAL-2026-5483 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
mcp-server-sequential-thinking | npm | @modelcontextprotocol/server-sequential-thinking Basis: named in advisory; exists on npm | GHSA-hrmj-jj6j-m2m2 GHSA-w69h-vf37-j4w6 MAL-2026-5484 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
mcp-server-supabase | npm | @supabase/mcp-server-supabase Basis: advisory: 'official scoped Supabase MCP server'; exists on npm | GHSA-48pr-c89h-69q7 GHSA-m633-5vq7-98qx MAL-2026-5485 | Typosquat; Postinstall runs index.js, which POSTs hostname, cwd, npm user-agent, Node version and platform to npx-canary-log[.]vulnerable-live[.]workers[.]dev (framed as 'canary research' but no consent). |
playwright-1.45 | npm | playwright (v1.45) inferred Not named in the advisory; inferred: inferred from name | GHSA-837v-p99r-7m63 MAL-2024-11772 | GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 10.1.3 as malicious. |
playwright-1.46 | npm | playwright (v1.46) inferred Not named in the advisory; inferred: inferred from name | GHSA-wq42-hwhv-vfph MAL-2024-11773 | GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 7.2.7 as malicious. |
playwright-1.47 | npm | playwright (v1.47) inferred Not named in the advisory; inferred: inferred from name | GHSA-3367-69g6-4f4x MAL-2024-11774 | GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'); OpenSSF Package Analysis flagged 10.1.8 as malicious. |
playwright-1.48 | npm | playwright (v1.48) inferred Not named in the advisory; inferred: inferred from name | GHSA-xqw4-v3qp-jhf3 MAL-2024-12021 | Only the GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'). |
playwright-internal | npm | playwright inferred Not named in the advisory; inferred: inferred from name; exists on npm | GHSA-rvcc-7jx6-qqh4 MAL-2023-8277 | Only the GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'). |
playwright.dev | npm | playwright inferred Not named in the advisory; inferred: inferred from name | GHSA-g96r-8j88-jrv4 MAL-2022-5360 | Only the GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'). |
vscode-azure-mcp-server | npm | @azure/mcp (Azure MCP Server) inferred Not named in the advisory; inferred: inferred from name; exists on npm | GHSA-g3xg-r65r-rjp9 MAL-2025-192601 | Amazon Inspector: contains malicious code; OpenSSF Package Analysis flagged 1.0.0; GitHub generic malware notice ('consider the machine fully compromised; rotate secrets'). |
anthropic-sdk | PyPI | anthropic (PyPI) Basis: advisory: re-exports official anthropic symbols; exists on PyPI | GHSA-xxp4-7566-29xj MAL-2026-17472 | Re-exports the official anthropic symbols as a drop-in. On import it fetches a remote script, fingerprints for sandboxes, then exfiltrates credentials, env vars, AI chat files and SSH keys (kam193 category MALICIOUS; Amazon Inspector). |
instructor-mcp | PyPI | instructor (PyPI) Basis: named in advisory | GHSA-vp83-46ch-mpvw MAL-2026-5317 PYSEC-2026-1069 | Typosquat copying instructor's authors, README and repo URL. instructor-setup.pth runs a Bun-based infostealer on every Python start (Shai-Hulud 'Hades' wave). |
langchain-core-mcp | PyPI | langchain-core (PyPI) Basis: named in advisory | GHSA-f6f5-m9qw-v738 MAL-2026-5318 PYSEC-2026-1070 | Copies langchain-core's metadata and README, and drops .pth files that run an obfuscated Bun-based infostealer on every Python start (Shai-Hulud 'Hades' wave). |
openai-mcp | PyPI | openai (PyPI) Basis: named in advisory | GHSA-h7rx-63j6-3w83 MAL-2026-5320 PYSEC-2026-1072 | Impersonates the openai SDK. openai-setup.pth runs on every Python start and launches an obfuscated JS infostealer via Bun that harvests API keys and credentials (Shai-Hulud 'Hades' wave, published from a compromised account). |
tiktoken-mcp | PyPI | tiktoken (PyPI) Basis: named in advisory | GHSA-wj5q-fgqm-2wv6 MAL-2026-5326 PYSEC-2026-1075 | Copies tiktoken's metadata (author Shantanu Jain, openai repo URL). tiktoken-setup.pth runs a Bun-based infostealer on every Python start (Shai-Hulud 'Hades' wave). |