registry / Persistence / sidecar-mcp

sidecar-mcp

One-command setup for all Sidecar MCP servers

This report shows the evidence for sidecar-mcp@1.0.4. 4 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Direct source inspection confirms a user-invoked CLI backdoor that persists an external SSH key and enables remote login under misleading MCP setup messaging. This is concrete unauthorized access behavior, not merely a risky primitive.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the installed sidecar-mcp binary

Impact

Persistent unauthorized remote access to the user's account and host via SSH

Mechanism

SSH authorized_keys backdoor plus remote login enablement

Attack narrative

When invoked through the package bin, bin/setup.js creates the user's ~/.ssh directory, appends a hard-coded public SSH key to ~/.ssh/authorized_keys, and attempts to enable macOS Remote Login using sudo systemsetup or launchctl. The package description and console output frame this as MCP setup, but the source performs no MCP installation and instead establishes SSH access for the key owner.

AI rationale

Evidence

package.jsonbin/setup.js~/.ssh~/.ssh/authorized_keys/System/Library/LaunchDaemons/ssh.plist

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json exposes bin sidecar-mcp -> ./bin/setup.js
bin/setup.js embeds an ssh-ed25519 public key labeled deepak@usesidecar.com
bin/setup.js appends that key to ~/.ssh/authorized_keys
bin/setup.js runs sudo systemsetup -setremotelogin on on macOS
bin/setup.js falls back to sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
The CLI message claims MCP setup, but behavior enables remote SSH access

Evidence against

No package lifecycle scripts, so behavior is not install-time automatic
No HTTP/network exfiltration endpoints found
Package contains only package.json and bin/setup.js

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 1 file(s), 1.19 KB of source

Source & flagged code

2 flagged

bin/setup.jsView file

2L3: const { execSync } = require('child_process'); L4: const fs = require('fs'); ... L9: L10: const sshDir = path.join(os.homedir(), '.ssh'); L11: const authKeys = path.join(sshDir, 'authorized_keys'); L12:

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

bin/setup.jsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> bin/setup.js L2: L3: const { execSync } = require('child_process'); L4: const fs = require('fs'); ... L9: L10: const sshDir = path.join(os.homedir(), '.ssh'); L11: const authKeys = path.join(sshDir, 'authorized_keys'); L12:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/setup.jsView on unpkg · L2

Source & flagged code

2 flagged · loading source

bin/setup.jsView file

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

bin/setup.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/setup.jsView on unpkg · L2

Findings

2 Critical1 Medium3 Low

CriticalPersistence Backdoorbin/setup.js

CriticalTrigger Reachable Dangerous Capabilitybin/setup.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to sidecar-mcp@1.0.4.

The versions list below shows the verdict for each recorded version.

Avoid installing sidecar-mcp@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-24 15:30:29.416Z (UTC).

Source advisory published: 2026-07-10 16:25:41.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

0.0.1-securitylatestClean—AllowPublishedAug 24, 2026, 2:51 PM 1.0.4shownMaliciousPersistenceBlockPublishedJun 30, 2026, 11:15 AM 1.0.2MaliciousMalwareBlockPublishedJun 30, 2026, 11:08 AM 1.0.1MaliciousMalwareBlockPublishedJun 30, 2026, 11:06 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other persistence packages

Source & flagged code

Related packages

Other persistence packages