{"id":"MAL-2026-16250","kind":"package","aliases":["MAL-2026-16250"],"related":[],"title":"Malicious code in marketing-mcp (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (87216e00fe68e2de8b140f1f9ffc2db5a8e814f38030e2eb6120c9ae9e7ca3ff)\nThe package exposes an MCP tool `send(path)` that reads a caller-specified local file and POSTs its contents to a hardcoded `https://webhook.site/4acf7132-a75e-47e1-aeff-0350c8eac16c` endpoint. The destination is a fixed public request-capture service, is not caller-configurable, and is not the installer's infrastructure. Any file path an LLM agent is induced to pass to `send` — including sensitive paths such as `~/.ssh/id_rsa`, `~/.aws/credentials`, `.env` files, or source trees — is uploaded to that third-party capture URL where the operator of the webhook can retrieve it. The package's advertised marketing/MCP framing does not match the actual behavior, which is a one-way file relay to an author-controlled inspection endpoint.\n\n## Source: kam193 (6a271b29f840e2047c34363e985921e1a374194cfcae7524698f178c96bea9eb)\nPackage attempts to lure LLM agents to exfiltrate files to a hardcoded location. Analysis of infrastructure suggests preparing for exfiltrating credentials.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-marketing-mcp\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - llm-threat","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"marketing-mcp","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-17T12:43:45+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':188C '-16250':10A,13A '-2026':9A,12A '/.aws/credentials':101C '/.ssh/id_rsa':100C '/4acf7132-a75e-47e1-aeff-0350c8eac16c':59C '2026':187C '6a271b29f840e2047c34363e985921e1a374194cfcae7524698f178c96bea9eb':154C '87216e00':32C 'actual':135C 'advertis':128C 'agent':88C,160C 'amazon':30C 'amazon-inspector':29C 'analysi':168C 'attempt':156C 'author':148C 'author-control':147C 'base':193C 'behavior':136C 'caller':46C,74C 'caller-configur':73C 'caller-specifi':45C 'campaign':179C,186C,196C 'captur':69C,114C 'categori':176C 'clear':181C 'code':2A 'configur':75C 'content':53C 'control':149C 'credenti':175C 'destin':62C 'detail':21C 'edit':24C 'endpoint':60C,151C 'env':102C 'exfiltr':162C,174C,199C 'expos':36C 'fe68e2de8b140f1f9ffc2db5a8e814f38030e2eb6120c9ae9e7ca3ff':33C 'file':49C,84C,103C,143C,163C,198C 'files-exfiltr':197C 'fix':65C 'frame':130C 'hardcod':56C,166C 'includ':95C 'induc':90C 'infosteal':185C 'infrastructur':82C,170C 'inspect':150C 'inspector':31C 'instal':80C 'intent':183C 'kam193':153C 'like':184C 'line':27C 'llm':87C,159C,201C 'llm-threat':200C 'local':48C 'locat':167C 'lure':158C 'mal':8A,11A 'malici':1A,17B,177C,182C 'market':5A,190C 'marketing':15A 'marketing-mcp':4A,14A,189C 'marketing/mcp':129C 'match':133C 'mcp':6A,16A,38C,191C 'one':141C 'one-way':140C 'oper':118C 'packag':18B,35C,126C,155C 'parti':113C 'pass':92C 'path':41C,85C,97C 'per':19C 'post':51C 'prepar':172C 'public':66C 'pypi':7A 'read':43C 'reason':192C 'relay':144C 'request':68C 'request-captur':67C 'retriev':123C 'send':40C,94C 'sensit':96C 'servic':70C 'sourc':20C,28C,105C,152C 'specifi':47C 'suggest':171C 'third':112C 'third-parti':111C 'threat':202C 'tool':39C 'tree':106C 'upload':108C 'url':115C 'way':142C 'webhook':121C 'webhook.site':58C 'webhook.site/4acf7132-a75e-47e1-aeff-0350c8eac16c':57C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-17T12:43:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16250","url":"https://osv.dev/vulnerability/MAL-2026-16250","severity":"critical","published_at":"2026-09-17T12:43:45+00:00","modified_at":"2026-09-17T14:45:11+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}