MAL-2026-13414
Dashboard / Malicious Package / MAL-2026-13414
MAL-2026-13414
Summary: Malicious code in @atom8n/inspector (npm)
Details: Source: amazon-inspector (5b72c3643bb990395103d396d62440db908b84769c904d4c14aa9b259f97807c) This @atom8n/-scoped package impersonates Anthropic's official MCP inspector (package.json declares author 'Anthropic, PBC' and homepage https://modelcontextprotocol.io, with bug tracker at github.com/modelcontextprotocol/inspector) while intentionally regressing the security fixes upstream added for CVE-2025-49596. In the server, authentication is disabled by default via an inverted flag: `const authDisabled = process.env.DANGEROUSLY_OMIT_AUTH!== "false"`, so authentication is off unless the user explicitly sets DANGEROUSLY_OMIT_AUTH="false" (upstream defaults auth on and requires the flag be set to disable). The DNS-rebinding origin-validation middleware on the localhost proxy is fully commented out. The proxy's createTransport reads `query.command` and spawns it via `StdioClientTransport({command: cmd, args, env})`. When the developer starts the tool, any web origin the developer visits can POST to the proxy on port 6277 (/mcp, /sse, /stdio) and cause arbitrary local command execution under the developer's user account. The package also references an out-of-tree script `.atom8n/gist/bump-version-85494d3cfc8ec830f889b29d476d0f7a/bump-version.mjs` that is not present in the tarball. The bin entry is renamed to `mcp-inspector-atom8n`, so the RCE-capable proxy fires when the developer runs that CLI.
Affected packages
Package
Name: @atom8n/inspector
Purl: pkg:npm/%40atom8n/inspector
Affected ranges
Type: N/A
Events:
