GitHub flags two more npm packages impersonating MCP servers as malware

GitHub Security Advisories published two advisories on November 12, 2026 and November 13, 2026, warning developers that the npm packages @go-gost/mcp-darwin-x64 and karma365-mcp contain embedded malicious code disguised as tooling for Model Context Protocol (MCP) servers, as detailed in GitHub's advisory for @go-gost/mcp-darwin-x64.

The two advisories

• Advisory GHSA-gfpg-48q7-c68h, published November 12, 2026, covers npm package @go-gost/mcp-darwin-x64 version 0.1.0
• Advisory GHSA-72xc-q3v8-7grp, published November 13, 2026, covers npm package karma365-mcp version 2.1.0
• Both are classified under CWE-506 (Embedded Malicious Code) and have no patched version available
• Both package names mimic legitimate MCP server binaries to lure developers who are installing MCP tooling for coding agents
• GitHub advises that any computer with either package installed or running should be considered fully compromised

What it means for people building with AI

The advisories mark a continuing wave of npm supply-chain attacks that specifically impersonate MCP server packages, a direct risk to developers installing MCP tooling for AI coding agents. Anyone who added either package while setting up an MCP server for a coding assistant should treat the installation as a security incident rather than a simple dependency problem.

What to do if affected

• Rotate all secrets and keys immediately, and do so from a separate, uncompromised computer
• Uninstalling the package alone does not guarantee removal of all resulting malicious activity

Sources

• Malicious code in @go-gost/mcp-darwin-x64 (npm) (GitHub Security Advisories, November 12, 2026, official)
• Malicious code in karma365-mcp (npm) (GitHub Security Advisories, November 13, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.