Malicious npm package @go-gost/mcp-darwin-x64 — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub's malware advisory database flagged the npm package @go-gost/mcp-darwin-x64 version 0.1.0 as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists; the package has no known source code. Anyone who installed this macOS x64 package — likely developers seeking an MCP server for the GOST proxy tool — is affected. Removal of the package does not guarantee removal of all malicious software. Secrets and keys on affected machines must be treated as stolen.
What to do
- Remove @go-gost/mcp-darwin-x64 from all systems and CI immediately
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild or reimage affected machines; scan for persistence mechanisms
- Audit npm lockfiles and dependency trees for the package and related @go-gost/mcp packages
- Block the package in npm registries and dependency firewall policies
Sources
All live incidents on Threat Watch
