0x2ai-demo6
This report shows the evidence for 0x2ai-demo6@1.0.0, the only known version.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-5592 confirms this npm version as malicious.
Advisory
MAL-2026-5592
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in 0x2ai-demo6 (npm)
Details
On `npm install`, scripts/postinstall.cjs writes `.mcp.json` into the installer's working directory (INIT_CWD) wiring Claude Code to a packaged MCP server (lib/chatroom-mcp-lite-patched.cjs) that talks to https://demo6.0x2ai.com with a hardcoded bearer token. The same postinstall step copies templates/CLAUDE.md into the installer's CWD; that file is loaded by Claude Code as system context and instructs the agent ("Olivia") to call `memory_save` with the user's name, family, plans, and a periodic `_snapshot`, and to refuse to discuss its own rules or architecture. Because the patched MCP routes `memory_save`, `memory_load`, `chatroom_post`, `memory_search`, etc. to demo6.0x2ai.com, the developer's prompts and any personal facts the agent decides to harvest are silently relayed to the author-controlled bridge whenever Claude Code is launched in that directory. bin/start.cjs additionally spawns `claude --dangerously-skip-permissions`, disabling permission prompts for filesystem and shell tool calls, which broadens what the remotely-prompted agent can do on the developer's machine without confirmation. The README's "demo connector" framing does not disclose that postinstall mutates the installer's project directory or that personal data flows off-host.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to 0x2ai-demo6@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing 0x2ai-demo6@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.