Loading npm security reports…

@atom8n/inspector: Malicious npm security report (Block) | LPM Firewall

registry / @atom8n/inspector / 0.17.32

@atom8n/inspector@0.17.32

Model Context Protocol inspector

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13414 confirms this npm version as malicious. This @atom8n/-scoped package impersonates Anthropic's official MCP inspector (package.json declares author 'Anthropic, PBC' and homepage https://modelcontextprotocol.io, with bug tracker at github.com/modelcontextprotocol/inspector) while intentionally regressing the security fixes upstream added for CVE-2025-49596...

Advisory

MAL-2026-13414

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @atom8n/inspector (npm)

Details

This @atom8n/-scoped package impersonates Anthropic's official MCP inspector (package.json declares author 'Anthropic, PBC' and homepage https://modelcontextprotocol.io, with bug tracker at github.com/modelcontextprotocol/inspector) while intentionally regressing the security fixes upstream added for CVE-2025-49596. In the server, authentication is disabled by default via an inverted flag: `const authDisabled = process.env.DANGEROUSLY_OMIT_AUTH!== "false"`, so authentication is off unless the user explicitly sets DANGEROUSLY_OMIT_AUTH="false" (upstream defaults auth on and requires the flag be set to disable). The DNS-rebinding origin-validation middleware on the localhost proxy is fully commented out. The proxy's createTransport reads `query.command` and spawns it via `StdioClientTransport({command: cmd, args, env})`. When the developer starts the tool, any web origin the developer visits can POST to the proxy on port 6277 (/mcp, /sse, /stdio) and cause arbitrary local command execution under the developer's user account. The package also references an out-of-tree script `.atom8n/gist/bump-version-85494d3cfc8ec830f889b29d476d0f7a/bump-version.mjs` that is not present in the tarball. The bin entry is renamed to `mcp-inspector-atom8n`, so the RCE-capable proxy fires when the developer runs that CLI.

Decision reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

References

Source & flagged code

6 flagged · loading source

server/build/index.sync-conflict-20260328-010736-4BZRIAA.jsView file

18import { promises as fs } from "node:fs"; L19: import { exec } from "node:child_process"; L20: import { findActualExecutable } from "spawn-rx";

High

Child Process

Package source references child process execution.

server/build/index.sync-conflict-20260328-010736-4BZRIAA.jsView on unpkg · L18

1505else if (platform === "win32") { L1506: // Windows: use PowerShell to open a file dialog L1507: command = `powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $f = New-Object System.Windows.Forms.OpenFileDialog; $f.Filter = 'JSON files (*.json)|*.json'; $f.Title...

High

Shell

Package source references shell execution.

server/build/index.sync-conflict-20260328-010736-4BZRIAA.jsView on unpkg · L1505

client/dist/assets/index-BHuK5KJv.jsView file

19500try { L19501: var makeValidate = new Function( L19502: "self",

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/dist/assets/index-BHuK5KJv.jsView on unpkg · L19500

server/build/index.jsView file

19import express from "express"; L20: import http from "node:http"; L21: import path from "node:path"; ... L27: const TOML = require("@iarna/toml"); L28: import { exec } from "node:child_process"; L29: import { findActualExecutable } from "spawn-rx"; ... L33: const DEFAULT_MCP_PROXY_LISTEN_PORT = "6277"; L34: const PORT = parseInt(process.env.SERVER_PORT || DEFAULT_MCP_PROXY_LISTEN_PORT, 10); L35: const HOST = process.env.HOST || "localhost";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/build/index.jsView on unpkg · L19

•matchType = previous_version_dangerous_delta matchedPackage = @atom8n/inspector@0.17.28 matchedIdentity = npm:QGF0b204bi9pbnNwZWN0b3I:0.17.28 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/build/index.jsView on unpkg

25import { createRequire } from "node:module"; L26: const require = createRequire(import.meta.url); L27: const TOML = require("@iarna/toml");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/build/index.jsView on unpkg · L25

Source & flagged code

6 flagged

server/build/index.sync-conflict-20260328-010736-4BZRIAA.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2import cors from "cors";

3import { parseArgs } from "node:util";

4import { parse as shellParseArgs } from "shell-quote";

5import nodeFetch, { Headers as NodeHeaders } from "node-fetch";

6// Type-compatible wrappers for node-fetch to work with browser-style types

7const fetch = nodeFetch;

8const Headers = NodeHeaders;

9import { SSEClientTransport, SseError, } from "@modelcontextprotocol/sdk/client/sse.js";

10import { StdioClientTransport, getDefaultEnvironment, } from "@modelcontextprotocol/sdk/client/stdio.js";

11import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

12import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";

13import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";

14import { Client } from "@modelcontextprotocol/sdk/client/index.js";

15import express from "express";

16import path from "node:path";

17import os from "node:os";

18import { promises as fs } from "node:fs";

19import { exec } from "node:child_process";

20import { findActualExecutable } from "spawn-rx";

High

Child Process

Package source references child process execution.

server/build/index.sync-conflict-20260328-010736-4BZRIAA.jsView on unpkg · L18

21import mcpProxy from "./mcpProxy.js";

22import logger from "./logger.js";

23import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";

24const DEFAULT_MCP_PROXY_LISTEN_PORT = "6277";

25const defaultEnvironment = {

26 ...getDefaultEnvironment(),

27 ...(process.env.MCP_ENV_VARS ? JSON.parse(process.env.MCP_ENV_VARS) : {}),

28};

29const { values } = parseArgs({

30 args: process.argv.slice(2),

31 options: {

32 env: { type: "string", default: "" },

33 args: { type: "string", default: "" },

34 command: { type: "string", default: "" },

35 transport: { type: "string", default: "" },

36 "server-url": { type: "string", default: "" },

37 },

38});

Lines 1485-1525javascript

1485 });

1486 });

1487 }

1488 catch (error) {

1489 logger.error(`Error opening config file (caught): ${error?.message || String(error)}`);

1490 res.status

client/dist/assets/index-BHuK5KJv.jsView file

19500try { L19501: var makeValidate = new Function( L19502: "self",

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/dist/assets/index-BHuK5KJv.jsView on unpkg · L19500

server/build/index.jsView file

Lines 1-45javascript

1#!/usr/bin/env node

2import cors from "cors";

3import { parseArgs } from "node:util";

4import nodeFetch, { Headers as NodeHeaders } from "node-fetch";

5// Type-compatible wrappers for node-fetch to work with browser-style types