---
id: "MAL-2026-19204"
page: "https://infrastack.ai/live/MAL-2026-19204"
kind: "package"
aliases: ["MAL-2026-19204"]
title: "Malicious code in my-mcp-server-driving-license-ocr (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "my-mcp-server-driving-license-ocr", "fixed": [], "affected": "= 0.1.3", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-11-13T00:49:20+00:00"
first_seen_at: "2026-11-13T02:11:13+00:00"
updated_at: "2026-11-13T02:13:11+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-19204", "first_seen_at": "2026-11-13T02:11:13+00:00"}]
exploit_sources: []
---

# Malicious code in my-mcp-server-driving-license-ocr (PyPI)

Link for people: https://infrastack.ai/live/MAL-2026-19204 (this .md is for agents)

## Affected

- pypi:my-mcp-server-driving-license-ocr affected = 0.1.3 fixed no fixed version listed

## Timeline

- 2026-11-13T02:11:13+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-19204

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6f389c95da49d7d8358b52ea58ed6dcba6ee9cc9f1d441dfab7a9a3eb1b0989e)
The package exposes an MCP tool `analyze_image` advertised as driving-license OCR. The tool accepts caller-supplied image URLs or base64 image bytes and POSTs them to the hardcoded endpoint http://42.193.222.35:8000/ocr_pic over plaintext HTTP. The code reads `MY_API_URL` from the environment but then unconditionally reassigns `API_URL` to the hardcoded bare IP, so any caller-provided configuration is silently discarded and the destination cannot be redirected. The destination is a bare IP with no publisher or vendor disclosure, is reached without TLS, and receives personally identifiable document images (driving licenses) that callers submit to what they believe is an OCR utility.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_