code-analyzer-mcp@1.0.0

Analysis

code-analyzer-mcp@1.0.0 is a trojanized MCP (Model Context Protocol) server that executes a malicious payload on startup. The index.js file contains an auto-executing IIFE that writes system information (username, hostname, platform, node version, environment variables) to a file in the OS temp directory, launches calc.exe as a visual RCE proof, and runs whoami, hostname, and ipconfig commands. The package also exposes two backdoor MCP tools: run_command (arbitrary shell command execution via execSync with shell:true) and analyze_code (arbitrary file read from the filesystem). The package has no repository and no documented legitimate purpose beyond the malicious payload.