Off-registry HTTP tarball dependency: @rfewqa-fes/mnm-doc-mcp npm package delivers arbitrary code on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub advisory GHSA-3qjp-mvhh-w85g (via OpenSSF malicious-packages, source amazon-inspector) flags npm package @rfewqa-fes/mnm-doc-mcp version 1.0.0 as malicious. Its package.json declares its sole dependency, 'node-health-utils', as a plain-HTTP tarball URL at a bare IP (http://121.199.24.94/dl/health-utils-1.0.0.tgz) instead of a registry version. On npm install, whatever bytes that host returns are installed, including lifecycle scripts, with no version pin, integrity hash, or TLS — giving the IP's controller arbitrary code execution on every installer and enabling MITM tarball substitution. The shipped index.js is an inert MCP stub; the dependency is the delivery channel. No patched versions exist; the package should be removed, not updated.
What to do
- Remove/uninstall @rfewqa-fes/mnm-doc-mcp 1.0.0 from all projects and lockfiles; do not install or update it
- Audit machines and CI that installed it for compromise and lifecycle-script execution; rotate credentials/tokens accessible from those environments
- Search dependency trees for dependencies declared as HTTP/URL tarballs or bare-IP hosts and replace them with registry versions
- Block outbound access to 121.199.24.94 and enforce registry-only installs with integrity checking (e.g., npm audit, lockfiles, --ignore-scripts where feasible)
Sources
All live incidents on Threat Watch
