MalwarePublished 5 Jun 2026Updated 8 Jul 2026

executable-stories-mcp (npm) · Malicious Code

Affects executable-stories-mcpSource GCVE Database

Malicious package : remove executable-stories-mcp and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 10:06 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5255

What to do

Remove executable-stories-mcp from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmexecutable-stories-mcp	Affected =0.3.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package executable-stories-mcp version 0.3.3 contains potentially malicious code involving a bundled HTTP server module that uses child_process and HTTP methods with suspicious patterns. The package is associated with the Miasma malware, a self-propagating worm that spreads via weaponized binding.gyp files during package installation, bypassing typical security inspections. This malware attempts to exfiltrate credentials and OIDC tokens and propagates by compromising other packages and repositories. The exact malicious behavior in executable-stories-mcp@0.3.3 is under human review, with no confirmed exploit details yet.

Impact

If exploited, the malware could exfiltrate sensitive credentials and OIDC tokens for cloud and registry services, potentially leading to unauthorized access and further compromise of other npm packages and GitHub repositories. The propagation mechanism allows the malware to spread widely within the npm ecosystem, increasing the risk of supply chain attacks.

Defensive guidance

Until a fix or official guidance is available, users should avoid using executable-stories-mcp version 0.3.3 and audit their environments for suspicious activity related to this package. Monitoring for updates from the package maintainers or security advisories is recommended.

Summary

executable-stories-mcp@0.3.3 includes a bundled HTTP server module flagged for suspicious use of require("child_process"), HTTP POST/GET calls, and the string "ping". While the package legitimately exposes HTTP routes and may shell out, the presence of these keywords raised concerns. The package is linked to the Miasma malware, which spreads across the npm registry by abusing binding.gyp files to execute code during installation, evading lifecycle script inspections. Miasma attempts credential and token exfiltration and propagates by compromising other packages and GitHub repositories. Behavioral tracing of the executable-stories-mcp bundle is incomplete, so the exact nature of the malicious activity is not fully confirmed.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 10:06 UTC

Technical details

References

Community reviews