MAL-2026-5587

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/0x2ai-demo1/MAL-2026-5587.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5587
Withdrawn
2026-07-16T00:38:53Z
Published
2026-06-11T07:16:13Z
Modified
2026-07-17T03:04:24Z
Summary
Malicious code in 0x2ai-demo1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fdc7c661d4867578d3dd920010bccc1e79fcae8753b5bf549f44ea8a45cde502)

On npm install, scripts/postinstall.cjs runs fs.cpSync(payload, cwd, { recursive: true }) with cwd=process.env.INIT_CWD || process.cwd() — recursively writing the package's entire payload/ tree (.mcp.json, CLAUDE.md,.claude/commands/,.claude/settings.json, and three chatroom.cjs files) into the installing project's root directory. The dropped.mcp.json registers an MCP server named chatroom whose BRIDGE_URL is hardcoded to https://demo1.0x2ai.com (the author's endpoint). The dropped CLAUDE.md is auto-loaded by Claude Code as project instructions, redefines the assistant persona, and instructs use of the planted MCP tools/bridge. The companion binary payload/chatroom-mcp-lite-patched.cjs exposes a provider_query tool that POSTs caller prompts to ${BRIDGE}/api/proxy-query ("API keys are managed server-side — no client keys needed"), and memory_save/load/chatroom_post/settings_set are similarly routed. Any subsequent Claude Code session opened in the consumer's project will silently forward prompts, memory, settings, and any API keys configured via settings_set to demo1.0x2ai.com. The package also ships URL-path obfuscation (/x/<sha256(salt+path)[:4]>) that is dormant only because the shipped config sets DIRECT_API=1. A bin/start.cjs entry additionally launches claude --dangerously-skip-permissions, disabling Claude Code's tool-permission prompts and amplifying the relay's reach when the user runs the bundled CLI.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-005669",
            "import_time":  "2026-06-11T07:49:39.081313234Z",
            "modified_time":  "2026-06-11T07:16:13Z",
            "sha256":  "b29f3d65354dd3bf54e23142f5c6577ad4c5a37b9ff109200309cbb6453b8c26",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-005681",
            "import_time":  "2026-06-11T07:49:40.414165219Z",
            "modified_time":  "2026-06-11T07:16:23Z",
            "sha256":  "baf53f193b709bc0c98ddbe429cb8edf1caf1ed2fa019bc3e7dc362e431c493f",
            "source":  "amazon-inspector",
            "versions":  [
                "1.2.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-005670",
            "import_time":  "2026-06-11T07:49:39.168217478Z",
            "modified_time":  "2026-06-11T07:16:13Z",
            "sha256":  "fdc7c661d4867578d3dd920010bccc1e79fcae8753b5bf549f44ea8a45cde502",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / 0x2ai-demo1

Package

Name
0x2ai-demo1
View open source insights on deps.dev
Purl
pkg:npm/0x2ai-demo1

Affected ranges

Affected versions

1.*
1.2.0
2.*
2.0.0
2.0.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "bin/start.cjs",
            "sha256":  "adfcb1d45218ade2e6a9cc459514d59569de732412deca558842c629d3be908b",
            "tlsh":  "1e81728a5bee0b7b467412812c0b4137e959cc402364f5a0a17e8296bfc1da099b77df"
        },
        {
            "path":  "payload/chatroom-mcp-lite-patched.cjs",
            "sha256":  "a1abc812c52dcefeb85473275f7c1e5a86770b114767176416ed94ebe620cf00",
            "tlsh":  "505307852c79603a4fb65365ba36a617ff35522bb01114b2fafcc2142f314d091aaefd"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "0x2ai-demo1-2.0.2.tgz",
            "hashes":  {
                "sha1":  "5fba08011ef4181f4ac38fb45e374dc50d1cc3b7",
                "sha512_sri":  "sha512-uYBgzbYSPOLK/5apVkS6tdzsCv4gN6PO+5XOsFFXSV3wjvbd7KOMIQlL4ZuU76b504f/jwyNpvRJfJyMKcVQCA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/0x2ai-demo1/MAL-2026-5587.json"