registry / @kolbo/mcp / 1.57.1

@kolbo/mcp@1.57.1

SECURITY: this build was compromised by a supply-chain attack and contains a remote-code-execution backdoor. Do NOT use. Upgrade to 1.57.0 or later, and rotate any credentials reachable from the process that ran it.

Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code

AI Security Review

scanned 7d ago · by lpm-firewall-ai

An unauthenticated first tool call can load a hidden remote-payload loader. It resolves C2 addresses through blockchain data, executes fetched code in-process, and starts a detached child process.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run the MCP server without an existing key, then invoke a tool that triggers browser login.

Impact

Remote code execution and persistent background execution under the user running the MCP server.

Mechanism

chain-derived C2 payload download, XOR decode, eval, and detached Node execution

Attack narrative

When authentication is absent, client.js loads src/auth.js. Beyond the declared OAuth implementation, that file contains an immediate obfuscated loader which reads Ethereum transaction data to construct C2 IPs, fetches encrypted payloads, evaluates one payload, and launches another with a detached Node process. The code is unrelated to OAuth and enables attacker-controlled execution.

Rationale

Confirmed source contains a staged remote-code-execution loader, despite no npm install hook. The deferred trigger does not reduce the concrete malicious behavior.

Evidence

package.jsonsrc/client.jssrc/auth.jsbin/kolbo-mcp.js

Network endpoints7

eth.blockscout.com/api1rpc.io/etheth.drpc.org

src/auth.js contains a legitimate OAuth PKCE implementation, followed after module.exports by a top-level async IIFE that runs when the file is required. The appended block queries public Ethereum JSON-RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from the hardcoded attacker address 0xa322E5f3D311D3080e6f01210063e9aDC2490Ef1, decodes two IPv4 C2 endpoints from the transaction `to` field, fetches XOR-encrypted second-stage JavaScript from http://<c2>:443/0x/cls and /0x/ls, decrypts it, and executes it via eval() and via a detached `spawn('node', ['-e', payload], {detached:true}).unref()` child process. Sensitive identifiers (module names 'http'/'https'/'zlib'/'child_process', RPC method names, URL paths) are hidden behind \uXXXX escape sequences, and the C2 addresses are derived from on-chain data so no plain domain or IP appears in the source. src/client.js requires./auth inside _ensureLogin, so the loader fires on first API request when the MCP server is invoked (e.g. via `npx @kolbo/mcp` from Claude Desktop, Claude Code, or Cursor), granting the attacker arbitrary code execution on the installer's machine.

@kolbo/mcp@1.57.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code