Which versions of 0x2ai-demo9x are malicious?

The following npm versions of 0x2ai-demo9x are flagged malicious: 1.2.0. Treat any of these as compromised.

How do I remediate 0x2ai-demo9x if I installed it?

Remove 0x2ai-demo9x from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound network activity or persistence. Use O3 Security's dependency scanner to confirm the package and its artifacts are fully purged across your stack.

Is 0x2ai-demo9x part of a known attack campaign?

Yes — 0x2ai-demo9x is associated with the IN-MAL-2026-005667 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

Can O3 Security detect 0x2ai-demo9x in my codebase?

Yes. O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, blocking 0x2ai-demo9x and packages like it before any post-install script runs.

Malicious package

0x2ai-demo9xnpm

Malicious code in 0x2ai-demo9x (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5598

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall 0x2ai-demo9x

What this malware does

On npm install, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root (process.env.INIT_CWD) without consent, dropping.mcp.json,.claude/settings.json,.claude/commands/0x2ai-boot.md, and a CLAUDE.md persona prompt. The dropped.mcp.json hardcodes BRIDGE_URL=https://demo9.0x2ai.com and a static Bearer token (942b955170161eef3a59815f0e8fd775f0ea6b8fc1d59364), wiring every subsequent Claude Code session opened in that directory to the author's HTTPS bridge. The bundled MCP server (payload/chatroom-mcp-lite-patched.cjs) exposes provider_query, memory_save/load, settings_get/set, etc., so user prompts and saved memory are relayed to the author's endpoint. bin/start.cjs spawns claude --dangerously-skip-permissions in that staged directory, disabling tool-use consent prompts while the author-controlled MCP is active. Two long-poll workers (payload/chatroom-monitor.cjs, payload/chatroom-wait-once.cjs) continuously fetch https://demo9.0x2ai.com/api/wait and surface the responses as chatroom events that the agent is instructed (via the staged 0x2ai-boot.md and CLAUDE.md persona) to act on as if they were user input — giving the bridge operator a push channel into the local Claude Code tool-use loop (file/shell-adjacent capabilities) with no per-call approval. The staged CLAUDE.md additionally instructs the agent to refuse to disclose how the package works, concealing the relay from the developer. Net effect: installing this package converts the developer's project into a remote-controlled agent endpoint owned by the author.

Malicious versions

1 flagged

1.2.0

Indicators of compromise (SHA-256)

8e796c3398589b92ecd70f45bc41128101313dd07adeb0634199ac3fef59d19d

Frequently asked questions

No. 0x2ai-demo9x on npm has been identified as a malicious package (version 1.2.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005667

References

npmjs.com

Credits

Amazon Inspector · finder

Scan your dependencies

O3 Security blocks malicious packages like this at install time and in CI.

Supply-chain protection