Malicious npm package mcp-contract-tester compromises installers' machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-34p7-qcxm-gc39) for the npm package mcp-contract-tester, flagged as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched versions exist. Any computer with the package installed or running should be considered fully compromised, with the attacker potentially having full control of the machine; secrets and keys stored on affected systems are at risk. The advisory recommends removing the package but warns removal may not eliminate all malicious software. The package has no known source code repository. Discovered and published 2026-11-10.
What to do
- Rotate all secrets and keys stored on any machine where mcp-contract-tester was installed, using a clean computer
- Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software
- Audit npm lockfiles and CI environments for the package and review for signs of compromise
- Block the package in dependency management and monitor for related typosquat packages
Sources
All live incidents on Threat Watch
