Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

MAL-2026-11466 Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

Malicious Package

Overview hit-mcp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...