Security1 hOctober 17, 2026, 01:01

Fake REA repo distributed a trojan posing as an MCP server

On October 13, 2026, an issue in the REA repository (morluto/rea) reported a fake rea-tools/rea repo that copied the README and pointed to an archive containing a Windows trojan. Microsoft Defender flagged it as Trojan:Script/Wacatac.B!ml, 8 of 45 VirusTotal engines agreed, and the archive had 172 downloads. The rea-tools organization was created on October 10 and held a single repository.

DEV Community

Open source

Fake REA repo distributed a trojan posing as an MCP server

Fake rea-tools/rea copied the README and linked to an 82.6 MB trojan archive
Defender flagged it as Trojan:Script/Wacatac.B!ml; 8 of 45 VirusTotal engines agreed
The archive had 172 downloads; the rea-tools org was created on October 10
The maintainer closed the issue the same day via PR #2429

#REA#GitHub#Npm

Malicious npm Package Poses as Twilio Security Tool, Steals Credentials

Security

North Korean hackers posed as recruiters, infected 30,000 devices

Security

AI Agents Become a New Malware Distribution Channel

Security

Fake REA repo distributed a trojan posing as an MCP server

Malicious npm Package Poses as Twilio Security Tool, Steals Credentials

North Korean hackers posed as recruiters, infected 30,000 devices

AI Agents Become a New Malware Distribution Channel

Fake recruiter sends trojan disguised as an anti-bot terminal check