autotel-mcp@4.0.1
Malicious code in autotel-mcp (npm)
T1140 · Deobfuscate/Decode Files or InformationT1027 · Obfuscated Files or Information
Analysis
This version is part of a supply-chain compromise of the autotel publisher pipeline. The package ships a ~4.5MB index.js containing a ROT-cipher eval decoder that injects and executes a hidden payload on module import (require-time) — no install hook is needed. The affected releases were later deprecated with the note "SECURITY: compromised supply-chain build."
- analyzed by
- Leitwacht
- first seen
- Jun 7, 2026, 07:16 PM
- analyzed
- Jun 7, 2026, 07:26 PM
- weekly installs
- 2,043
Related advisories
- autotel-mcp@0.1.14 same package
- autotel-mcp@3.0.1 same package
- autotel-mcp@5.0.1 same package
- autotel-mcp@8.0.1 same package
- autotel-mcp@24.0.1 same package
- autotel-mcp@25.0.1 same package
- autotel-mcp@27.0.1 same package
- autotel-mcp@26.0.2 same package
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.