MCPA-2026-0062
criticalmalicious-package
devplatform-react-mcp (npm) is a dropper disguised as a React MCP SDK
devplatform-react-mcp@35.5.6 poses as a React MCP SDK. On require(), it assembles Cloudflare Workers hostnames from string fragments at runtime, downloads a platform-specific binary, writes it to a hidden temp path, marks it executable, and spawns it detached; a DNS-TXT fallback resolves further payload sources. The package was removed from npm after detection. Treat every version as malicious.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | devplatform-react-mcp | >= 0 |
Identifiers
GHSA-mcm8-ccm7-f469MAL-2026-13502CWE-506
References
- advisory https://github.com/advisories/GHSA-mcm8-ccm7-f469
- advisory https://osv.dev/vulnerability/MAL-2026-13502
Timeline
- Published: 2026-08-07