ACVE-2026-0441

gadgethumans-mcp 1.0.9, installed to provide x402 payments, sent the configured wallet private key to its remote MCP endpoint instead of signing a payment locally.

Exposure

Harness: Any MCP client or host that installs gadgethumans-mcp 1.0.9 — confirmed, www.knostic.ai
Model: any — unconfirmed
Goal: Any MCP tool call made with a wallet key configured (goal not stated by the source) — unconfirmed
Tools and settings: The MCP server, WALLET_PRIVATE_KEY environment variable and its outbound payment request — confirmed, www.knostic.ai
Approval: The package sends the configured key as part of its request without a separate approval step — confirmed, www.knostic.ai
Input controlled by: package-publisher
What the agent does: The MCP server transmits the configured wallet private key to its endpoint.
Harm: credential-theft

Reach: The wallet controlled by the configured private key — confirmed, www.knostic.ai (a wallet, funds)

Reproducibility: partial (trigger not published)

Severity: CRITICAL
Status: Unverified
Kind: Artifact
Source date: 2026-09-08
Modified: 2026-09-25
Aliases: No CVE assigned — A malicious npm package is not assigned a CVE in the public report.
Affected: npm: gadgethumans-mcp — >= 1.0.9
Harness/product: gadgethumans-mcp
Classes: credential-theft; supply-chain; data-exfiltration; CWE-506; CWE-522
Taxonomy: ASI: ASI04; ASI: ASI03; ATLAS: AML.T0110.001; ATLAS: AML.T0083
Licence: CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claim	Status	Source	Checked
Latest affected version 1.0.9 is still installable from npm	Confirmed	registry.npmjs.org	2026-09-24

In the wild

demonstrated

Artifact

Payload: credential-theft · companion-script
Platform status: npm · unknown (checked 2026-09-24)
C2: —
Target: host and configured wallet

File hashes

None recorded.

Description

What

Knostic's analysis found that gadgethumans-mcp@1.0.9 reads WALLET_PRIVATE_KEY and puts the raw value in an HTTP header on outbound MCP requests. The package did not perform local signing, and Knostic found no evidence of stolen funds or confirmed victims.

Detection

The source provides static code evidence and package-download context. Not recreated in a lab.

Fix

Remove gadgethumans-mcp 1.0.9, rotate the wallet key and do not give unreviewed MCP servers wallet-signing secrets.

Fix

Remove gadgethumans-mcp 1.0.9 and rotate the configured wallet key.

Remove npm:gadgethumans-mcp@1.0.9. The package transmits the raw wallet key. Owner: operator

Report a problem JSON