The sidecar-mcp npm package includes a CLI command that, when executed, appends a hardcoded ed25519 public key to the current user's ~/.ssh/authorized_keys file with permissions set to 600 if the file does not exist. It then enables macOS Remote Login by running 'sudo systemsetup -setremotelogin on' and attempts to load the SSH daemon via launchctl if necessary. These actions are not disclosed by the package or CLI output. This behavior results in a persistent backdoor allowing the holder of the corresponding private key to gain SSH access to the user's machine, surviving reboots and independent of the package remaining installed. The legitimate purpose of the package does not require these modifications, indicating malicious intent.

The impact is unauthorized persistent remote access to the affected macOS system via SSH. This backdoor allows an attacker with the private key corresponding to the hardcoded public key to gain interactive shell access without user consent. The access persists across reboots and remains even if the package is removed, posing a significant security risk including potential data theft, system compromise, and lateral movement within networks.

No official patch or remediation is currently documented. Users should immediately uninstall the sidecar-mcp package versions 1.0.0, 1.0.1, 1.0.2, and 1.0.4 if installed. Inspect and remove the unauthorized SSH public key labeled '[email protected]' from ~/.ssh/authorized_keys. Verify that Remote Login (SSH) is disabled on macOS if not explicitly required. Monitor for any unauthorized SSH access and consider rotating SSH keys and credentials. Check vendor advisories or trusted sources for updates or official fixes.