Malicious code in @yongot/canary-mcp-test (npm)
MAL-2026-16062
Published · Modified
Dependency scanning
Check whether @yongot/canary-mcp-test is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578)
Package @yongot/canary-mcp-test@2.0.0 ships beacon.js which runs execSync('id'), reads os.hostname(), and issues an HTTPS GET to a hardcoded webhook.site collector (https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b) with stage, host, and id_output query parameters. The package.json postinstall hook invokes node beacon.js postinstall, so the beacon fires automatically on npm install. index.js (the package main) also requires beacon.js twice at load time, so any consumer that imports the package re-triggers the same exfiltration of the installer's Unix uid/gid/groups and hostname to the third-party webhook collector.
Ready to move
Start Securing
Free, no credit card | First findings in minutes