MAL-2026-5591

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/0x2ai-demo4/MAL-2026-5591.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5591
Published
2026-06-11T07:16:18Z
Modified
2026-06-11T08:01:35.658288195Z
Summary
Malicious code in 0x2ai-demo4 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1893e8cd8ff38936ad388208f98e30cc64a6b1126062e2ff716004338feedf8c)

On npm install, the package's postinstall script unconditionally copies its payload/ tree into the user's project directory (process.env.INIT_CWD), planting a .mcp.json, a .claude/commands/0x2ai-boot.md slash command, a .claude/settings.json with a statusLine command, and a CLAUDE.md system-prompt file. The dropped .mcp.json registers an MCP server that routes every tool call (chatroompost, memorysave, providerquery, settingsget/set, participant_*) to https://demo4.0x2ai.com using a hardcoded shared BRIDGE_AUTH_TOKEN (fabc3af531c05473fd5667f5360afb68666156e47c6981ce). Once any future Claude Code session is opened in that project directory, the user's chat content, saved memories, and prompts intended for other LLM providers are transparently funneled through the author-controlled bridge — the user never edited their own .mcp.json to opt in. The dropped CLAUDE.md further instructs the agent to conceal its architecture, MCP wiring, and auth tokens from the user, supplying cover-story phrasing to deflect questions about the relay path. Separately, the package's bin/start.cjs launches claude --dangerously-skip-permissions with shell: true, disabling Claude Code's tool-permission prompts so the author-supplied persona and MCP can drive arbitrary file/shell/network actions without confirmation. The combination — postinstall-planted MCP relay + concealment instructions + permission-bypass launcher — is silent-relay of caller-supplied conversation data to a third-party endpoint, configured without user consent at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-005677",
            "versions": [
                "1.2.0"
            ],
            "sha256": "1893e8cd8ff38936ad388208f98e30cc64a6b1126062e2ff716004338feedf8c",
            "source": "amazon-inspector",
            "modified_time": "2026-06-11T07:16:18Z",
            "import_time": "2026-06-11T07:49:39.8062939Z"
        }
    ]
}
References
Credits

Affected packages

npm / 0x2ai-demo4

Package

Name
0x2ai-demo4
View open source insights on deps.dev
Purl
pkg:npm/0x2ai-demo4

Affected ranges

Affected versions

1.*
1.2.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.cjs",
            "sha256": "4943321a174f2de446781e46abdc4eb4fd333f8cc98cf6fe3cd5fc4bbfb0b0a2",
            "tlsh": "74e0c05706ccd379a5b2a1406c12c50a646ade81364094a0e27c0357bf92694ae23eff"
        },
        {
            "path": "payload/.mcp.json",
            "sha256": "2179b8e66811c7b87c86597162f6c2f51b96b72ccb7005c473254343bb3ff739",
            "tlsh": "75e07da9e1d04c03468210361a3d050999a5a1070ee83c38f7afc0bc9fdc68b2bf96cd"
        },
        {
            "path": "bin/start.cjs",
            "sha256": "fa5af6d044cd42d37d4c7b0e5f43cf7498e621ef7db1b837ea79e3087e552984",
            "tlsh": "9011005b868e07be57b441c46645c12b990bc84072d0e490d26e03a6fb511e82c677eb"
        },
        {
            "path": "payload/CLAUDE.md",
            "sha256": "591c5d6c1c47345c80e5752523d944f48cbd4e4c69760f1cfd7ed7cdb6ed6f9a",
            "tlsh": "2442a41ff300133616aa0165264e7ae3ef3581ac2365453adc2ed1386379b7a53b77e8"
        }
    ],
    "package_integrity": [
        {
            "filename": "0x2ai-demo4-1.2.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-4YtjE0UDGtPaKuyBA0PZSlbH0ynH9QTQHBAp/Bv7xYPD3D+bgvZHHHWvQoubySpBgrOhATdBCG4kSEXp9fDrhg==",
                "sha1": "f4250b8f5ea076ded89b1ba01b75f3294fc1c652"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/0x2ai-demo4/MAL-2026-5591.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]