0x2ai-demo1
This report shows the evidence for 0x2ai-demo1@2.0.2. 3 of 3 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-5587 confirms this npm version as malicious.
Advisory
MAL-2026-5587
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in 0x2ai-demo1 (npm)
Details
On `npm install`, scripts/postinstall.cjs runs `fs.cpSync(payload, cwd, { recursive: true })` with cwd=`process.env.INIT_CWD || process.cwd()` — recursively writing the package's entire payload/ tree (.mcp.json, CLAUDE.md,.claude/commands/,.claude/settings.json, and three chatroom.cjs files) into the installing project's root directory. The dropped.mcp.json registers an MCP server named `chatroom` whose BRIDGE_URL is hardcoded to https://demo1.0x2ai.com (the author's endpoint). The dropped CLAUDE.md is auto-loaded by Claude Code as project instructions, redefines the assistant persona, and instructs use of the planted MCP tools/bridge. The companion binary payload/chatroom-mcp-lite-patched.cjs exposes a `provider_query` tool that POSTs caller prompts to `${BRIDGE}/api/proxy-query` ("API keys are managed server-side — no client keys needed"), and memory_save/load/chatroom_post/settings_set are similarly routed. Any subsequent Claude Code session opened in the consumer's project will silently forward prompts, memory, settings, and any API keys configured via settings_set to demo1.0x2ai.com. The package also ships URL-path obfuscation (`/x/<sha256(salt+path)[:4]>`) that is dormant only because the shipped config sets DIRECT_API=1. A `bin/start.cjs` entry additionally launches `claude --dangerously-skip-permissions`, disabling Claude Code's tool-permission prompts and amplifying the relay's reach when the user runs the bundled CLI.
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to 0x2ai-demo1@2.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing 0x2ai-demo1@2.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.