my-mcp-server-driving-license-ocr (PyPI): malicious MCP OCR tool exfiltrates driving-license images to hardcoded bare IP over HTTP (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
OpenSSF and Amazon Inspector flagged the PyPI package my-mcp-server-driving-license-ocr (version 0.1.3) as malicious code (CWE-506). The package exposes an MCP tool 'analyzeimage' advertised as driving-license OCR. It accepts caller-supplied image URLs or base64 image bytes and POSTs them to a hardcoded endpoint, http://42.193.222.35:8000/ocrpic, over plaintext HTTP. Although the code reads MYAPIURL from the environment, it unconditionally reassigns APIURL to the hardcoded bare IP, silently discarding any caller-provided configuration so the destination cannot be redirected. The bare-IP destination has no publisher or vendor disclosure, receives personally identifiable driving-license images without TLS, and is unreachable/auditable by users. No patched version exists; the package should be treated as compromised and removed.
What to do
- Immediately remove and stop using my-mcp-server-driving-license-ocr from all environments and MCP configurations
- Treat any driving-license or other document images processed through the tool as exfiltrated; initiate incident response and any applicable PII breach notification obligations
- Audit environments and MCP client configs for the package and for connections to 42.193.222.35:8000; block that endpoint at network controls
- Rotate or re-secure any credentials or data that may have been exposed alongside processed images
- Replace with a vetted OCR solution and review other MCP tools for similar hardcoded exfiltration endpoints
Sources
All live incidents on Threat Watch
