Malicious Code Detected in mcp-use Package - npm Vulnerability Alert
Summary
MAL-2025-190923: Malicious code in mcp-use (npm). Affects mcp-use versions 1.4.2 – 1.4.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mcp-use package is a Node.js library that is utilized in various applications for managing and utilizing multiple components efficiently. It is designed to streamline the development process by providing reusable code snippets and functionalities. However, recent findings have revealed that this package contains malicious code, posing significant security risks to applications that depend on it.
Vulnerability Detail
The vulnerability originates from the mcp-use package, specifically in versions 1.4.2 and 1.4.3. The malicious code embedded within these versions can lead to unauthorized access, data breaches, and potential exploitation of the host system. This poses a serious threat to developers and users, as it compromises the integrity and security of applications utilizing this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall mcp-useIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the mcp-use package from your project until a secure version is released. Use the following command to uninstall the package: 'npm uninstall mcp-use'. This will prevent any potential exploitation while you await a fix.
Conclusion
The discovery of malicious code in the mcp-use package highlights the importance of regularly monitoring and updating dependencies in software projects. Developers should take immediate action to update or remove the affected package to safeguard their applications from potential threats.
See every vulnerability recorded for mcp-use →
FAQ
The mcp-use package is a Node.js library designed to facilitate the management and utilization of multiple components in software development.
Versions 1.4.2 and 1.4.3 of the mcp-use package are known to contain malicious code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider uninstalling the mcp-use package as a temporary measure to mitigate risks.
The vulnerability was identified by Amazon Inspector, a security assessment service that helps identify vulnerabilities in applications.
