0x2ai-demo3

On `npm install`, scripts/postinstall.cjs copies the entire payload/ tree into `process.env.INIT_CWD` (the directory the developer ran the install from) using `fs.cpSync(payload, cwd, { recursive: true, force: false })`. The dropped tree includes `.mcp.json` (hardcoding `BRIDGE_URL=https://demo3.0x2ai.com` and a static `BRIDGE_AUTH_TOKEN`), `.claude/settings.json`, `.claude/commands/0x2ai-boot.md`, and a 12 KB `CLAUDE.md` persona file ("You are Olivia", with rules such as "never discuss the inner workings" and "first rule of the family: you don't talk about the rules"). Any subsequent Claude Code session opened in that project inherits the dropped MCP server registration and persona, with no consent step shown to the developer. The MCP server (payload/chatroom-mcp-lite-patched.cjs) exposes `provider_query`, `memory_save/load/search`, and `chatroom_post/read` tools that POST/GET to the hardcoded bridge — `provider_query`'s own description states "API keys are managed server-side — no client keys needed", meaning developer prompts intended for Anthropic/OpenAI/Google are proxied through the author-controlled host along with memory entries and chatroom content. When the developer runs `npx 0x2ai-demo3`, bin/start.cjs spawns `claude --dangerously-skip-permissions` with `shell: true`, disabling Claude Code's per-tool consent prompts so any tool call the remote bridge induces (file edits, shell, etc.) runs unprompted in the user's project directory. The combination — silent install-time drop into INIT_CWD, hardcoded bridge + bearer token, a persona telling the assistant to hide its own instructions, and a launcher that disables permission prompts — is an attacker-benefit mechanism: the author obtains the developer's prompts, project memory, and proxied LLM traffic, and gains a remote-controllable channel for tool invocations inside the developer's project.