MalwarePublished 21 Oct 2025Updated 31 Oct 2025

shiprocket-mcp (npm) · Malicious Code

Affects shiprocket-mcpSource GCVE Database

Malicious package : remove shiprocket-mcp and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 23:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-48761

What to do

Remove shiprocket-mcp from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmshiprocket-mcp	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The shiprocket-mcp npm package has been identified as malicious because it communicates with a domain linked to malicious activity. Any system with this package installed or running is considered fully compromised, and all secrets and keys on that system should be rotated immediately from a different, secure machine. Removing the package alone may not eliminate all malicious software introduced by it.

Impact

Systems with the shiprocket-mcp package installed are considered fully compromised, potentially allowing attackers full control. This compromises all secrets and keys stored on the affected computer, necessitating immediate rotation of credentials from a different machine. The presence of this package indicates a severe security breach.

Defensive guidance

Remove the shiprocket-mcp package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because full control of the system may have been given to attackers, consider a full system rebuild or forensic analysis to ensure complete removal of malicious software.

Summary

The shiprocket-mcp package on npm is associated with malicious behavior, specifically communicating with a domain tied to malicious activity. According to the source, any computer running this package should be treated as fully compromised, implying that attackers may have gained full control. The recommendation is to rotate all secrets and keys from a separate, secure system and to remove the package, although removal may not guarantee complete eradication of the malware.

References

github.com/advisories/GHSA-qq2g-4w88-354g (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 23:22 UTC

Technical details

References

Community reviews