VV-263criticalSupply chain2026-11-12

Malicious npm packages posing as MCP servers: @rfewqa-fes/mnm-doc-mcp, @lemili9804/mcp-weather-server and mcp-contract-tester

Three npm packages named like MCP servers or MCP tooling were reported as malware between 10 and 12 November 2026. GitHub says any computer that installed @lemili9804/mcp-weather-server (1.0.3, 1.0.6) or mcp-contract-tester (all versions) should be treated as fully compromised. @rfewqa-fes/mnm-doc-mcp 1.0.0 pulls its only dependency as an unpinned tarball over plain HTTP from a bare IP address.

01.

What it is

@rfewqa-fes/mnm-doc-mcp 1.0.0 (MAL-2026-19148, 12 Nov): Amazon Inspector found that package.json declares its sole dependency, 'node-health-utils', as an off-registry HTTP tarball at http://121.199.24.94, so npm install fetches and runs whatever that server returns, including lifecycle scripts, with no version pin, integrity hash or TLS.

@lemili9804/mcp-weather-server 1.0.3 and 1.0.6 (GHSA-qwfq-cw9x-55x4, 10 Nov): GitHub malware advisory.

mcp-contract-tester, all versions (GHSA-34p7-qcxm-gc39, 10 Nov): GitHub malware advisory.

For both GitHub reports the guidance is that the machine should be considered fully compromised, and removing the package may not remove everything it installed.

02.

How to check

Search lockfiles and global installs for these names, and check any MCP client config (Claude Desktop, Cursor, VS Code) that launches them with npx.

03.

How to fix

Remove the packages and the MCP config entries that start them.
From a different, clean machine, rotate every secret and key that was on the affected computer, and consider reinstalling it.
Block outbound traffic to 121.199.24.94 if you installed mnm-doc-mcp.

grep -rE 'mnm-doc-mcp|mcp-weather-server|mcp-contract-tester' package-lock.json pnpm-lock.yaml yarn.lock ~/.cursor ~/Library/Application\ Support/Claude 2>/dev/null
npm ls -g --depth=0 | grep -E 'mnm-doc-mcp|mcp-weather-server|mcp-contract-tester'

04.

Sources

More advisories for this tool