code-assist-mcp @1.0.0
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 12:52 PM UTC
OSV ID
MAL-2026-14233
Ecosystem
npm
Summary
code-assist-mcp@1.0.0 runs a postinstall lifecycle script that collects host identifiers (hostname, platform, arch, Node version, package name) and POSTs them as JSON to the hardcoded host m743pyrm.instances.poc.jchunt.top at path /code-assist-mcp. The beacon fires automatically on npm install without user opt-in. The package name resembles Google's platform-ai code-assist tooling, consistent with a dependency-confusion or typosquat reconnaissance beacon confirming code execution on installer build machines.
Source: amazon-inspector (093f28fd5542ee841027c5b3dc6917a42ac13dd3e0e1d3bf334e87b823886d3c)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.