{"id":"MAL-2026-18780","kind":"package","aliases":["MAL-2026-18780"],"related":[],"title":"Malicious code in @massnerder/x402-scraper-mcp (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (3c2359d61951f070234818950891a0ad6daca0a77d897b33992d5dba40d5b119)\nThe OpenSSF Package Analysis project identified '@massnerder/x402-scraper-mcp' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@massnerder/x402-scraper-mcp","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T13:15:48+00:00","first_seen_at":"2026-11-09T14:27:21+00:00","triaged_at":"2026-11-09T14:27:34+00:00","updated_at":"2026-11-09T14:41:14+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18780':8A,11A '-2026':7A,10A '1.0.0':37C '3c2359d61951f070234818950891a0ad6daca0a77d897b33992d5dba40d5b119':29C 'activ':55C 'analysi':28C,33C 'associ':52C 'code':2A 'communic':48C 'consid':43C 'detail':17C 'domain':51C 'edit':20C 'identifi':35C 'line':23C 'mal':6A,9A 'malici':1A,13B,40C,44C,54C 'massnerder/x402-scraper-mcp':4A,12A,36C 'npm':5A,38C 'openssf':31C 'ossf':26C 'ossf-package-analysi':25C 'packag':14B,27C,32C,47C 'per':15C 'project':34C 'sourc':16C,24C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["x402scrapermcp"],"ptokens":["massnerder","mcp","scraper","x402"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-18780':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'massnerder/x402-scraper-mcp':4A,12A 'npm':5A","search_b":"'malici':13B 'packag':14B","search_c":"'1.0.0':37C '3c2359d61951f070234818950891a0ad6daca0a77d897b33992d5dba40d5b119':29C 'activ':55C 'analysi':28C,33C 'associ':52C 'communic':48C 'consid':43C 'detail':17C 'domain':51C 'edit':20C 'identifi':35C 'line':23C 'malici':40C,44C,54C 'massnerder/x402-scraper-mcp':36C 'npm':38C 'openssf':31C 'ossf':26C 'ossf-package-analysi':25C 'packag':27C,32C,47C 'per':15C 'project':34C 'sourc':16C,24C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:15:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18780","url":"https://osv.dev/vulnerability/MAL-2026-18780","severity":"critical","published_at":"2026-11-09T13:15:48+00:00","modified_at":"2026-11-09T13:45:26+00:00","first_seen_at":"2026-11-09T14:27:21+00:00","fetched_at":"2026-11-09T14:27:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}