OpenSSF/OSV advisory MAL-2026-13988 confirms this npm version as malicious. The package's postinstall lifecycle script runs automatically on `npm install` and collects installer host identifiers (hostname, platform, arch, node version, package name, timestamp) and POSTs them to the hardcoded endpoint https://6cjhdzmo.instances.poc.jchunt.top/xrblocks-mcp...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in xrblocks-mcp (npm)
Details
The package's postinstall lifecycle script runs automatically on `npm install` and collects installer host identifiers (hostname, platform, arch, node version, package name, timestamp) and POSTs them to the hardcoded endpoint https://6cjhdzmo.instances.poc.jchunt.top/xrblocks-mcp. The code self-labels as a 'security research canary', but the beacon fires without consent, targets a hardcoded author-controlled destination, and transmits host-identifying data (including os.hostname()) that has no bearing on the package's declared functionality.
Decision reason
OpenSSF Malicious Packages via OSV confirms xrblocks-mcp@6.3.1 as malicious (MAL-2026-13988): Malicious code in xrblocks-mcp (npm)