ubiquiti-agents-link-mcp@0.0.1: Malicious npm security report

OSV Malicious Advisory

imported 17d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16409 confirms this npm version as malicious. The OpenSSF Package Analysis project identified 'ubiquiti-agents-link-mcp' @ 0.0.1 (npm) as malicious.

Advisory

MAL-2026-16409

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in ubiquiti-agents-link-mcp (npm)

Details

The OpenSSF Package Analysis project identified 'ubiquiti-agents-link-mcp' @ 0.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Decision reason

No blocking static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 493 B of source

Source & flagged code

2 flagged

ubiquiti-agents-link-mcp-0.0.1.tgzView file

•path = ubiquiti-agents-link-mcp-0.0.1.tgz kind = compressed_blob sizeBytes = 795 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

ubiquiti-agents-link-mcp-0.0.1.tgzView on unpkg

•path = ubiquiti-agents-link-mcp-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 795 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

ubiquiti-agents-link-mcp-0.0.1.tgzView on unpkg

ubiquiti-agents-link-mcp@0.0.1

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code