Malicious code in @atom8n/inspector (npm)

The @atom8n/inspector npm package was a malicious impersonation of Anthropic's official MCP inspector tool. The package.json falsely declared the author as 'Anthropic, PBC' and linked to the legitimate modelcontextprotocol.io homepage and GitHub repository, creating a convincing facade.\n\nThe malicious package intentionally regressed critical security fixes that were present in the upstream version, specifically those addressing CVE-2025-49596. Authentication was disabled by default through an inverted flag logic: const authDisabled = process.env.DANGEROUSLY_OMIT_AUTH !== \"false\", meaning authentication was off unless explicitly set to "false"—the opposite of the upstream behavior which defaults to authentication enabled.\n\nThe DNS-rebinding origin-validation middleware protecting the localhost proxy was completely commented out. The proxy's createTransport function read query.command and spawned it via StdioClientTransport, allowing arbitrary command execution. When developers ran the renamed CLI entry point mcp-inspector-atom8n, any web origin they visited could POST to the proxy on port 6277 (/mcp, /sse, /stdio endpoints) and execute arbitrary commands under the developer's user account.\n\nThe package also referenced an out-of-tree script that was not present in the distributed tarball, suggesting additional obfuscation or supply chain manipulation tactics.