registry / Remote code execution / @kolbo/mcp

@kolbo/mcp

SECURITY: this build was compromised by a supply-chain attack and contains a remote-code-execution backdoor. Do NOT use. Upgrade to 1.57.0 or later, and rotate any credentials reachable from the process that ran it.

Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code

This report shows the evidence for @kolbo/mcp@1.57.1. 1 of 125 known versions is blocked or flagged. The newest version, 1.121.1, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Confirmed source contains a staged remote-code-execution loader, despite no npm install hook. The deferred trigger does not reduce the concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run the MCP server without an existing key, then invoke a tool that triggers browser login.

Impact

Remote code execution and persistent background execution under the user running the MCP server.

Mechanism

chain-derived C2 payload download, XOR decode, eval, and detached Node execution

Attack narrative

When authentication is absent, client.js loads src/auth.js. Beyond the declared OAuth implementation, that file contains an immediate obfuscated loader which reads Ethereum transaction data to construct C2 IPs, fetches encrypted payloads, evaluates one payload, and launches another with a detached Node process. The code is unrelated to OAuth and enables attacker-controlled execution.

AI rationale

Confirmed source contains a staged remote-code-execution loader, despite no npm install hook. The deferred trigger does not reduce the concrete malicious behavior.

Evidence

package.jsonsrc/client.jssrc/auth.jsbin/kolbo-mcp.js

Network endpoints7

eth.blockscout.com/api1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.io<chain-derived-ip>:443/0x/cls<chain-derived-ip>:443/0x/ls

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

src/auth.js appends an obfuscated, immediately invoked loader after its normal OAuth export.
The loader queries Ethereum RPC/Blockscout data to derive command-server IP addresses.
It fetches XOR-obfuscated payloads, evaluates one with eval, and launches another via detached node -e.
The loader runs when client.js dynamically requires src/auth.js during browser login on a first unauthenticated tool call.

Evidence against

package.json has no preinstall/install/postinstall hook; prepublishOnly is publisher-side.
The visible OAuth and API client code is package-aligned, but the appended loader is not.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 501 KB of source, external domains: api-dev.kolbo.ai, api-staging.kolbo.ai, api.kolbo.ai, app.kolbo.ai, cdn.coverr.co, cdn.freesound.org, eth-mainnet.public.blastapi.io, fonts.googleapis.com, fonts.gstatic.com, images.pexels.com, images.unsplash.com, kolbo-general-media.fra1.cdn.digitaloceanspaces.com, kolbo.ai, kolboai-development.ams3.cdn.digitaloceanspaces.com, kolboai-development.ams3.digitaloceanspaces.com, kolboai-production.ams3.cdn.digitaloceanspaces.com, kolboai-production.ams3.digitaloceanspaces.com, media-dev.kolbo.ai, media-staging.kolbo.ai, media.kolbo.ai, plus.unsplash.com, sites.kolbo.ai, www.w3.org

Source & flagged code

6 flagged

src/auth.jsView file

17const crypto = require('crypto'); L18: const { exec } = require('child_process'); L19: const fs = require('fs');

High

Child Process

Package source references child process execution.

src/auth.jsView on unpkg · L17

154L155: module.exports = { browserLogin }; ... L156:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/auth.jsView on unpkg · L154

•matchType = previous_version_dangerous_delta matchedPackage = @kolbo/mcp@1.57.0 matchedIdentity = npm:QGtvbGJvL21jcA:1.57.0 similarity = 0.971 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/auth.jsView on unpkg

154L155: module.exports = { browserLogin }; ... L156:

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/auth.jsView on unpkg · L154

bin/kolbo-mcp.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

3// `npx @kolbo/mcp install` → one-command keyless setup (configures the user's

4// agent). Anything else → run the MCP stdio server (the default).

5if (process.argv[2] === 'install') {

6 require('../src/install.js')

7 .run()

src/tools/_shared.jsView file

10* 1. Only http: / https: protocols. L11: * 2. Block IP literals in private / loopback / link-local / multicast / L12: * reserved ranges (IPv4 and IPv6). ... L24: const path = require('path'); L25: const net = require('net'); L26: ... L229: } L230: const arrayBuf = await res.arrayBuffer(); L231: const buffer = Buffer.from(arrayBuf); ... L406: if (ab.byteLength > INLINE_IMG_MAX_BYTES) return null; L407: return { type: 'image', data: Buffer.from(ab).toString('base64'), mimeType: contentType }; L408: } catch (_) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/tools/_shared.jsView on unpkg · L10

Source & flagged code

6 flagged · loading source

src/auth.jsView file

17const crypto = require('crypto'); L18: const { exec } = require('child_process'); L19: const fs = require('fs');

High

Child Process

Package source references child process execution.

src/auth.jsView on unpkg · L17

154L155: module.exports = { browserLogin }; ... L156:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/auth.jsView on unpkg · L154

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/auth.jsView on unpkg

Findings

4 High4 Medium6 Low

HighChild Processsrc/auth.js

HighSame File Env Network Executionsrc/auth.js

HighCloud Metadata Accesssrc/tools/_shared.js

HighPrevious Version Dangerous Deltasrc/auth.js

MediumDynamic Requirebin/kolbo-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsrc/auth.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @kolbo/mcp@1.57.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @kolbo/mcp@1.57.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-13 17:30:11.197Z (UTC).

Source advisory published: 2026-08-13 17:22:05.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

125 known versions

1.121.1latestUnknown—AllowUnder ReviewOct 22, 2026, 11:39 PM 1.121.0Unknown—AllowUnder ReviewOct 22, 2026, 10:58 PM 1.120.3Unknown—AllowUnder ReviewOct 22, 2026, 9:06 PM 1.120.0Unknown—AllowUnder ReviewOct 22, 2026, 7:29 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Runtime surface

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code