ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0429

ACVE-2026-0429

feishu-docx-mcp 0.3.2, installed as an MCP server, carried the returned Shai-Hulud payload that could run on the host and steal credentials or alter agent settings.

Exposure

Harness
Any host that installs or runs feishu-docx-mcp 0.3.2 — confirmed, www.aikido.dev
Model
any — unconfirmed
Goal
Any task that installs or invokes the MCP server (goal not stated by the source) — unconfirmed
Tools and settings
feishu-docx-mcp 0.3.2 and its package payload, including developer-tool settings files — confirmed, www.aikido.dev
Approval
Package code runs without an agent approval step once installed — detected, www.aikido.dev
Input controlled by
package-publisher
What the agent does
The host runs the package payload, which can steal credentials and write persistence settings.
Harm
credential-theft

Reproducibility: not-reproducible (vulnerable components are not confirmed obtainable; trigger not published)

Severity
CRITICAL
Status
Unverified
Kind
Artifact
Source date
2026-09-07
Modified
2026-09-25
Aliases
No CVE assigned — A malicious npm package is not assigned a CVE in the public report.
Affected
  • npm: feishu-docx-mcp — >= 0.3.2
Harness/product
feishu-docx-mcp
Classes
supply-chain; credential-theft; CWE-506
Taxonomy
ASI: ASI04; ATLAS: AML.T0010.005; ATLAS: AML.T0011.001; ATLAS: AML.T0055
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

ClaimStatusSourceChecked
Latest affected version 0.3.2 is no longer on npm — Matches npm; version not found on npmUnavailableregistry.npmjs.org

In the wild

demonstrated · research

Artifact

Payload
credential-theft · companion-script
Platform status
npm · unknown (checked 2026-09-24)
C2
—
Target
host running the MCP server

File hashes

  • None recorded.

Description

What

Aikido reported that feishu-docx-mcp@0.3.2 was one of four npm packages published on September 7 with the same Shai-Hulud payload previously seen in the ecosystem. The payload included credential theft and persistence files used by developer tools.

Detection

Aikido identified the package by matching the payload hash across package releases.

Fix

Do not install the affected package; remove it if present and rotate credentials that were available to the host.

Fix

Remove feishu-docx-mcp 0.3.2 and rotate exposed credentials.

  • Remove npm:feishu-docx-mcp@0.3.2. The package release carried the reported malicious payload. Owner: operator

References

REPORT

Report a problemJSON