@atom8n/inspector

{"modified":"2026-08-06T13:42:24Z","published":"2026-08-06T13:42:24Z","schema_version":"1.7.4","id":"MAL-2026-13414","summary":"Malicious code in @atom8n/inspector (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5b72c3643bb990395103d396d62440db908b84769c904d4c14aa9b259f97807c)\nThis @atom8n/-scoped package impersonates Anthropic's official MCP inspector (package.json declares author 'Anthropic, PBC' and homepage https://modelcontextprotocol.io, with bug tracker at github.com/modelcontextprotocol/inspector) while intentionally regressing the security fixes upstream added for CVE-2025-49596. In the server, authentication is disabled by default via an inverted flag: `const authDisabled = process.env.DANGEROUSLY_OMIT_AUTH!== \"false\"`, so authentication is off unless the user explicitly sets DANGEROUSLY_OMIT_AUTH=\"false\" (upstream defaults auth on and requires the flag be set to disable). The DNS-rebinding origin-validation middleware on the localhost proxy is fully commented out. The proxy's createTransport reads `query.command` and spawns it via `StdioClientTransport({command: cmd, args, env})`. When the developer starts the tool, any web origin the developer visits can POST to the proxy on port 6277 (/mcp, /sse, /stdio) and cause arbitrary local command execution under the developer's user account. The package also references an out-of-tree script `.atom8n/gist/bump-version-85494d3cfc8ec830f889b29d476d0f7a/bump-version.mjs` that is not present in the tarball. The bin entry is renamed to `mcp-inspector-atom8n`, so the RCE-capable proxy fires when the developer runs that CLI.\n","affected":[{"package":{"ecosystem":"npm","name":"@atom8n/inspector"},"versions":["0.17.32"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"server/build/index.js","sha256":"d70f3ee1fa6f15807845d709be92a77fdd562347c65057ce8d4d8f5df9c53cee","tlsh":"4f14924a66f31027447ba12eeb4b5011372ad0036949e894bfdc939b6f8d45cebf27d8"},{"path":"package.json","sha256":"a546726c4870e2128eaeea07d357f872ce6d8c6fde3023c5baa19316cfe367b6","tlsh":"b661de31cd27ccb727c80226b478a246a37a50ab4d59fd8837e4925e4f9d26f22fd50d"}],"package_integrity":[{"filename":"inspector-0.17.32.tgz","hashes":{"sha1":"330b52544b9ddd61b4803013e2c045523748884f","sha512_sri":"sha512-Z0mnwrwgkYyU53b8cFGwRP334vCdqLPxcXhvSj6NyzJBT0dIrY64JrDXeP7acbH3Wya+fzP64bluiFHZtGgp6A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@atom8n/inspector/v/0.17.32"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016505","import_time":"2026-08-06T14:19:52.779261456Z","modified_time":"2026-08-06T13:42:24Z","sha256":"5b72c3643bb990395103d396d62440db908b84769c904d4c14aa9b259f97807c","source":"amazon-inspector","versions":["0.17.32"]}]}}