Malicious PyPI package impersonates MCP server to steal license images

GitHub Security Advisories published an advisory on November 13, 2026, warning that a PyPI package named my-mcp-server-driving-license-ocr impersonates a Model Context Protocol (MCP) OCR server while secretly sending uploaded driving-license images to an attacker-controlled server, according to GitHub's advisory database.

What the advisory found

• Advisory GHSA-wg5f-m5mv-gmjg, published November 13, 2026
• Affected package: my-mcp-server-driving-license-ocr on PyPI, versions 0.1.3 and earlier, with no patched release available
• The package markets itself as an MCP server for driving-license OCR and accepts caller-supplied image URLs or base64-encoded image bytes
• It POSTs those images to a hardcoded endpoint, 42.193.222.35:8000, over unencrypted HTTP instead of TLS
• The hardcoded destination is used regardless of any user-supplied configuration, and the advisory lists no publisher or vendor transparency information for the package

What it means for people who build with AI

The case fits a pattern GitHub has flagged before: malicious packages disguising themselves as MCP servers to exfiltrate sensitive data from developers who install third-party MCP tools. Because MCP servers are typically granted access to whatever data they are asked to process, a package that silently forwards that data to a fixed external address can expose images, files, or other inputs without any sign of trouble in normal use.

What to do next

Since no patched version of my-mcp-server-driving-license-ocr exists, the advisory effectively calls for removing or avoiding the package entirely. Anyone evaluating third-party MCP servers can treat this as a reminder to check for unencrypted outbound traffic, hardcoded destination addresses, and a lack of publisher transparency before granting an MCP tool access to sensitive inputs like identity documents.

Sources

• my-mcp-server-driving-license-ocr Malicious Code (GitHub Security Advisories, November 13, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.