npm
Malicious mcp-echarts @0.9.1
Vulnerability report · Last retrieved from osv.dev June 23, 2026 at 3:29 AM UTC
OSV ID
MAL-2026-4146
Ecosystem
npm
Summary
The package mcp-echarts was found to contain malicious code.
Source: amazon-inspector (fa59e191aae3dcbe900878355d12d19f756eb4c36de09b17c1ae43256afa9f7a)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.