MAL-2026-3448 Malicious code in @squawk/mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed4b99ef5ac5fd4f25fdd4844c49a608343d6596def04cfb9df850c40e927dc9 The package @squawk/mcp was found to contain malicious code. Source: ghsa-malware 7d06b20db1195e1e5566e553087c2be971625c4a648e9cbfe5c1e0e836b93aa9 An...

@squawk/mcp (>=0.2.0 <=0.9.0) potentially affected by unknown CVE via @squawk/airports (>=0.3.2 <=0.6.1)

@squawk/airports NPM version =0.3.2, =0.2.0, =0.9.0 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKAIRPORTS-16640888...

@squawk/mcp (>=0.2.0 <=0.9.0) potentially affected by unknown CVE via @squawk/fixes (>=0.1.4 <=0.3.1)

@squawk/fixes NPM version =0.1.4, =0.2.0, =0.9.0 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKFIXES-16640881...

@squawk/mcp (>=0.2.0 <=0.9.0) potentially affected by unknown CVE via @squawk/procedure-data (>=0.3.3 <=0.7.2)

@squawk/procedure-data NPM version =0.3.3, =0.2.0, =0.9.0 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKPROCEDUREDATA-16640883...

@squawk/mcp (>=0.4.1 <=0.8.1) potentially affected by unknown CVE via @squawk/airport-data (>=0.4.1 <=0.6.1)

@squawk/airport-data NPM version =0.4.1, =0.4.1, =0.8.1 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKAIRPORTDATA-16640876...

@squawk/mcp (>=0.4.1 <=0.8.1) potentially affected by unknown CVE via @squawk/airspace-data (>=0.3.2 <=0.4.0)

@squawk/airspace-data NPM version =0.3.2, =0.4.1, =0.8.1 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKAIRSPACEDATA-16640882...

@squawk/mcp (>=0.4.1 <=0.8.1) potentially affected by unknown CVE via @squawk/fix-data (>=0.4.1 <=0.5.2)

@squawk/fix-data NPM version =0.4.1, =0.4.1, =0.8.1 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKFIXDATA-16640873...

@squawk/mcp (>=0.4.1 <=0.8.1) potentially affected by unknown CVE via @squawk/airway-data (>=0.3.3 <=0.4.2)

@squawk/airway-data NPM version =0.3.3, =0.4.1, =0.8.1 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKAIRWAYDATA-16640895...

@squawk/mcp (>=0.2.0 <=0.9.0) potentially affected by unknown CVE via @squawk/icao-registry (>=0.2.3 <=0.5.1)

@squawk/icao-registry NPM version =0.2.3, =0.2.0, =0.9.0 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKICAOREGISTRY-16640891...