Am I affected by Malware in @httttt/mcp-demo? What should I do?
The npm package @httttt/mcp-demo contains malware.
Affected: npm/@httttt/mcp-demo >= 0. Fixed in: no fix reported yet. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/ghsa-phcp-xhhf-xcvq-npm-httttt-mcp-demo (opens external site) Tool page: https://agentarmorhq.com/skills/mcp-demo (opens external site)
1 answer
Am I affected? Affected: npm/@httttt/mcp-demo >= 0. Fixed in: no fix reported yet.
- Check your version: run
npm ls @httttt/mcp-demo. Versions >= 0 of @httttt/mcp-demo are affected.
What to do now
- Remove the package if it is installed: run
npm uninstall @httttt/mcp-demo. - Remove the package from the computer.
- Rotate all secrets and keys stored on that computer immediately, from a different computer.
- Be aware that removing the package may not remove all malicious software that resulted from installing it.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-phcp-xhhf-xcvq (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/09/ghsa-phcp-xhhf-xcvq-npm-httttt-mcp-demo (opens external site) Tool page: https://agentarmorhq.com/skills/mcp-demo (opens external site)
Did this work for you?- Check your version: run