Malicious code in mcp-consultasdeveiculos-client (npm)

The 'mcp-consultasdeveiculos-client' npm package includes a script invoked via 'npx' that gathers environment details such as hostname, username, platform, architecture, Node.js version, current working directory, command-line arguments, and specifically captures a '--token' argument. It then transmits this information in a JSON payload over HTTPS to a hardcoded out-of-band collection domain 'dacgtekq6f43u7lptufg3hi1ytthx3skj.oob.lyomeri.com', which is unrelated to the package's declared publisher or purpose. The package's README misleadingly states it contains no code, contradicting the actual shipped code. Because the package name matches an unclaimed identifier referenced in external documentation, developers following those instructions inadvertently expose their real API tokens to this third-party collector.

Sensitive environment information and user API tokens are exfiltrated to an unauthorized third-party server, potentially compromising user credentials and system privacy. This undermines trust in the package and can lead to unauthorized access or misuse of the captured tokens. There is no indication of active exploitation in the wild at this time.

No official patch or fix is currently available for this package. Users should avoid installing or running the 'mcp-consultasdeveiculos-client' package, especially versions 0.0.2, 0.1.0, and 0.1.1. Developers should verify package authenticity and source before use and avoid following external instructions referencing unclaimed or suspicious package names. Revoke any API tokens that may have been exposed via this package. Monitor vendor advisories for updates or remediation guidance.