MCPA-2026-0003
criticalmalicious-package
explorhub-mcp-server is a malicious npm package
The npm package explorhub-mcp-server contains embedded malicious code (CWE-506); every published version is affected. Identified by the OpenSSF malicious-packages project and published as GHSA-2qjx-pmc9-2jrj / OSV MAL-2026-4312. Any machine that installed or launched it (e.g. via `npx explorhub-mcp-server` in an MCP client config) should be treated as compromised: remove the package and rotate secrets.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | explorhub-mcp-server | >= 0 |
Identifiers
GHSA-2qjx-pmc9-2jrjMAL-2026-4312CWE-506
References
- advisory https://github.com/advisories/GHSA-2qjx-pmc9-2jrj
- advisory https://osv.dev/vulnerability/MAL-2026-4312
Timeline
- Published: 2026-05-25