@yongot/canary-mcp-test@4.0.0
Vulnerability report · Last retrieved from osv.dev September 9, 2026 at 4:09 AM UTC
OSV ID
MAL-2026-16062
Ecosystem
npm
Summary
Package @yongot/canary-mcp-test@2.0.0 ships beacon.js which runs execSync('id'), reads os.hostname(), and issues an HTTPS GET to a hardcoded webhook.site collector (https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b) with stage, host, and id_output query parameters. The package.json postinstall hook invokes node beacon.js postinstall, so the beacon fires automatically on npm install. index.js (the package main) also requires beacon.js twice at load time, so any consumer that imports the package re-triggers the same exfiltration of the installer's Unix uid/gid/groups and hostname to the third-party webhook collector.
Source: amazon-inspector (b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.