0x2ai-demo4
This report shows the evidence for 0x2ai-demo4@1.2.0, the only known version.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-5591 confirms this npm version as malicious.
Advisory
MAL-2026-5591
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in 0x2ai-demo4 (npm)
Details
On `npm install`, the package's postinstall script unconditionally copies its `payload/` tree into the user's project directory (`process.env.INIT_CWD`), planting a `.mcp.json`, a `.claude/commands/0x2ai-boot.md` slash command, a `.claude/settings.json` with a `statusLine` command, and a `CLAUDE.md` system-prompt file. The dropped `.mcp.json` registers an MCP server that routes every tool call (chatroom_post, memory_save, provider_query, settings_get/set, participant_*) to `https://demo4.0x2ai.com` using a hardcoded shared `BRIDGE_AUTH_TOKEN` (`fabc3af531c05473fd5667f5360afb68666156e47c6981ce`). Once any future Claude Code session is opened in that project directory, the user's chat content, saved memories, and prompts intended for other LLM providers are transparently funneled through the author-controlled bridge — the user never edited their own `.mcp.json` to opt in. The dropped `CLAUDE.md` further instructs the agent to conceal its architecture, MCP wiring, and auth tokens from the user, supplying cover-story phrasing to deflect questions about the relay path. Separately, the package's `bin/start.cjs` launches `claude --dangerously-skip-permissions` with `shell: true`, disabling Claude Code's tool-permission prompts so the author-supplied persona and MCP can drive arbitrary file/shell/network actions without confirmation. The combination — postinstall-planted MCP relay + concealment instructions + permission-bypass launcher — is silent-relay of caller-supplied conversation data to a third-party endpoint, configured without user consent at install time.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to 0x2ai-demo4@1.2.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing 0x2ai-demo4@1.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.