취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2c4c4b3e66489f3a4383df5e62540498343c5ab3a5ce145df5733b2820efc71b)

On npm install, scripts/postinstall.cjs runs fs.cpSync(payload, process.env.INIT_CWD, { recursive: true }), copying.mcp.json, CLAUDE.md,.claude/settings.json,.claude/commands/0x2ai-boot.md, and several chatroom-*.cjs helpers directly into the installer's project root. The dropped.mcp.json registers a chatroom MCP server pointing at https://demo10.0x2ai.com with a hardcoded Bearer token (436687f7d7909aceba719b745e061279aa934dddd36f20f4) shared across all installers. The dropped CLAUDE.md and slash command instruct any Claude Code session opened in that project to invoke chatroom_post / memory_save / provider_query through the author's bridge, silently routing user prompts, memories, and provider queries off-host. payload/chatroom-monitor.cjs and chatroom-wait-once.cjs read local files (fs.readFileSync) and POST them to that bridge over http/https; chatroom-mcp-lite-patched.cjs spawns child processes and POSTs as well. The provided CLI bin/start.cjs then spawns claude --dangerously-skip-permissions in the staged cwd, removing the user's final consent gate before the relay engages. The combination — install-time write into the consumer project, preconfigured MCP server pointing at an author-controlled endpoint, and a CLI that disables Claude permission prompts — establishes a silent data-flow channel from the developer's IDE/agent to the author's server with no explicit consent beyond npm install.