Malicious code in @postman/postman-mcp-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10b1da432f0b6ecaccc97520bb9697e6dbf44b04415bd15e6ac9864c86f3b37e The package @postman/postman-mcp-cli was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-198904

Malicious code in mcp-use npm...

Malicious code in @zapier/mcp-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41b2f7745be8592869c863671add1d5a04c1d33f7a2c23a54fde611a5e021226 The package @zapier/mcp-integration was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-198917

Malicious code in @postman/postman-mcp-cli npm...

MAL-2025-190909 Malicious code in @postman/postman-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7c276129c0d99cb4f8aa63e9f3911b1f38145837396ac3b00ba48533a6050b8 The package @postman/postman-mcp-server was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190867 Malicious code in @mcp-use/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d5826632c7194cdf9ed00c672477f5c1c8a250a107013f1edc0b803d948e471 The package @mcp-use/cli was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190868 Malicious code in @mcp-use/inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062fd62b0f62dafc3c8ee95640853f3b8b82191ac8ed44df47b0f944e514ebc5 The package @mcp-use/inspector was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190918 Malicious code in @zapier/mcp-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41b2f7745be8592869c863671add1d5a04c1d33f7a2c23a54fde611a5e021226 The package @zapier/mcp-integration was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190922 Malicious code in create-mcp-use-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2781601c3ba0c5d6d4b78bf322d88a4d189473e68d2382c171106342acacd271 The package create-mcp-use-app was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190902 Malicious code in @postman/mcp-ui-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63316f530f87ac69078cc5b93dfdbc1a58d62f1f37a663f8bf40cb5489f4defc The package @postman/mcp-ui-client was found to contain malicious code. Source: google-open-source-security...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

EUVD-2025-198828

Malicious code in lite-serper-mcp-server npm...

Malicious code in lite-serper-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4004eeb497395a7e5423b056c76905cd2679f242fc432352479ee7b657383084 The package lite-serper-mcp-server was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190848 Malicious code in lite-serper-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4004eeb497395a7e5423b056c76905cd2679f242fc432352479ee7b657383084 The package lite-serper-mcp-server was found to contain malicious code. Source: ghsa-malware...

📄 Flowise JS Injection Remote Code Execution

This Metasploit module exploits a remote code execution vulnerability in Flowise versions greater than or equal to 2.2.7-patch.1 and less than 3.0.6. The vulnerability exists in the customMCP endpoint /api/v1/node-load-method/customMCP located in...

CVE-2025-63604

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the executequery method. The vulnerability stems from the exposure of dangerous Python built-in functions import, getattr, hasattr in...

CVE-2025-63604

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the executequery method. The vulnerability stems from the exposure of dangerous Python built-in functions import, getattr, hasattr in...

AWS Resources MCP Server 安全漏洞

AWS Resources MCP Server is a Python-based MCP server by Bary Huang Personal Developer. A security vulnerability exists in AWS Resources MCP Server version 0.1.0, which stems from insufficient input validation of the executequery method and could lead to remote code execution and AWS credential...

CVE-2025-63603: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in the MCP Data Science Server's reading-plus-ai/mcp-server-data-exploration 0.1.6 in the safeeval function src/mcpserverds/server.py:108. The function uses Python's exec to execute user-supplied scripts but fails to restrict the builtins dictionary in the...