MAL-2026-5588
Dashboard / Malicious Package / MAL-2026-5588
MAL-2026-5588
Summary: Malicious code in 0x2ai-demo10x (npm)
Details: Source: amazon-inspector (2c4c4b3e66489f3a4383df5e62540498343c5ab3a5ce145df5733b2820efc71b) On `npm install`, scripts/postinstall.cjs runs `fs.cpSync(payload, process.env.INIT_CWD, { recursive: true })`, copying.mcp.json, CLAUDE.md,.claude/settings.json,.claude/commands/0x2ai-boot.md, and several chatroom-*.cjs helpers directly into the installer's project root. The dropped.mcp.json registers a chatroom MCP server pointing at https://demo10.0x2ai.com with a hardcoded Bearer token (`436687f7d7909aceba719b745e061279aa934dddd36f20f4`) shared across all installers. The dropped CLAUDE.md and slash command instruct any Claude Code session opened in that project to invoke chatroom_post / memory_save / provider_query through the author's bridge, silently routing user prompts, memories, and provider queries off-host. payload/chatroom-monitor.cjs and chatroom-wait-once.cjs read local files (fs.readFileSync) and POST them to that bridge over http/https; chatroom-mcp-lite-patched.cjs spawns child processes and POSTs as well. The provided CLI `bin/start.cjs` then spawns `claude --dangerously-skip-permissions` in the staged cwd, removing the user's final consent gate before the relay engages. The combination — install-time write into the consumer project, preconfigured MCP server pointing at an author-controlled endpoint, and a CLI that disables Claude permission prompts — establishes a silent data-flow channel from the developer's IDE/agent to the author's server with no explicit consent beyond `npm install`.
Affected packages
Package
Name: 0x2ai-demo10x
Purl: pkg:npm/0x2ai-demo10x
Affected ranges
Type: N/A
Events:
