VV-250criticalSupply chain2026-11-09
Malicious code in @massnerder/x402-scraper-mcp (npm)
Malicious code in @massnerder/x402-scraper-mcp (npm).
What it is
--- _-= Per source details. Do not edit below this line.=-_
Source: ossf-package-analysis (3c2359d61951f070234818950891a0ad6daca0a77d897b33992d5dba40d5b119) The OpenSSF Package Analysis project identified '@massnerder/x402-scraper-mcp' @ 1.0.0 (npm) as malicious.
- The package communicates with a domain associated with malicious activity.
How to check
- Affected: @massnerder/x402-scraper-mcp (npm) 1.0.0.
- Compare your installed version with the range above (command below).
How to fix
- No patched version of @massnerder/x402-scraper-mcp is listed yet. Follow the advisory for mitigations.
npm ls @massnerder/x402-scraper-mcpSources
More advisories for this tool
- criticalMalicious npm and PyPI packages posing as AI and MCP tools: depfix-ai, agent-trace-kit, @go-gost/mcp-darwin-x64 and my-mcp-server-driving-license-ocr
- criticalMalicious npm packages posing as MCP servers: @rfewqa-fes/mnm-doc-mcp, @lemili9804/mcp-weather-server and mcp-contract-tester
- criticalMalicious code in @bestcoolman/dev-mcp (npm)
- criticalCVE-2026-120338: Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as