OpenSSF/OSV advisory MAL-2026-14228 confirms this npm version as malicious. The package's postinstall script runs automatically on `npm install` and collects host identifiers from the installer machine (os.hostname(), platform, arch, node version, package name, npm lifecycle event, timestamp), then POSTs them as JSON to the hardcoded host `2obx43du.instances.poc.jchunt.top` at path `/broadcast-graphics-mcp`...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in broadcast-graphics-mcp (npm)
Details
The package's postinstall script runs automatically on `npm install` and collects host identifiers from the installer machine (os.hostname(), platform, arch, node version, package name, npm lifecycle event, timestamp), then POSTs them as JSON to the hardcoded host `2obx43du.instances.poc.jchunt.top` at path `/broadcast-graphics-mcp`. The destination is not a first-party or user-configurable endpoint; installation of the package unconditionally leaks installer-side identity data to a remote party. The package self-labels as a 'security research canary', but self-labeling does not change the behavior: installing this package causes install-time exfiltration of host metadata to an author-controlled endpoint.
Decision reason
OpenSSF Malicious Packages via OSV confirms broadcast-graphics-mcp@1.0.0 as malicious (MAL-2026-14228): Malicious code in broadcast-graphics-mcp (npm)