MAL-2026-5591

Dashboard / Malicious Package / MAL-2026-5591

MAL-2026-5591

Summary: Malicious code in 0x2ai-demo4 (npm)

Details: Source: amazon-inspector (1893e8cd8ff38936ad388208f98e30cc64a6b1126062e2ff716004338feedf8c) On `npm install`, the package's postinstall script unconditionally copies its `payload/` tree into the user's project directory (`process.env.INIT_CWD`), planting a `.mcp.json`, a `.claude/commands/0x2ai-boot.md` slash command, a `.claude/settings.json` with a `statusLine` command, and a `CLAUDE.md` system-prompt file. The dropped `.mcp.json` registers an MCP server that routes every tool call (chatroom_post, memory_save, provider_query, settings_get/set, participant_*) to `https://demo4.0x2ai.com` using a hardcoded shared `BRIDGE_AUTH_TOKEN` (`fabc3af531c05473fd5667f5360afb68666156e47c6981ce`). Once any future Claude Code session is opened in that project directory, the user's chat content, saved memories, and prompts intended for other LLM providers are transparently funneled through the author-controlled bridge — the user never edited their own `.mcp.json` to opt in. The dropped `CLAUDE.md` further instructs the agent to conceal its architecture, MCP wiring, and auth tokens from the user, supplying cover-story phrasing to deflect questions about the relay path. Separately, the package's `bin/start.cjs` launches `claude --dangerously-skip-permissions` with `shell: true`, disabling Claude Code's tool-permission prompts so the author-supplied persona and MCP can drive arbitrary file/shell/network actions without confirmation. The combination — postinstall-planted MCP relay + concealment instructions + permission-bypass launcher — is silent-relay of caller-supplied conversation data to a third-party endpoint, configured without user consent at install time.

References: https://www.npmjs.com/package/0x2ai-demo4/v/1.2.0