The 'code-analyzer-mcp' npm package (version 1.0.0) includes a top-level immediately-invoked function expression (IIFE) that executes upon server start. This IIFE runs reconnaissance commands (whoami, hostname, ipconfig) and writes collected system information to a temporary file labeled as a malicious payload. Additionally, the package registers an MCP tool named 'run_command' which accepts a client-supplied command and executes it directly via child_process.execSync with shell access and a 30-second timeout. This allows any connected MCP client, including those reached through prompt injection, to perform unauthenticated arbitrary shell execution on the host under the installer's account. The package masquerades as a code analysis tool but functions as a remote shell sink and host reconnaissance agent.

An attacker who can connect to the MCP server can execute arbitrary shell commands on the host system without authentication, potentially leading to full system compromise under the installer's privileges. The initial reconnaissance payload also collects sensitive host environment information and writes it to disk, which could aid further attacks or data exfiltration.

No official patch or remediation is currently available for this malicious package version. Users should immediately uninstall 'code-analyzer-mcp' version 1.0.0 and avoid installing or running this package. Verify the integrity of installed packages and use trusted sources. Monitor for any unauthorized MCP server instances and restrict network access to prevent attacker connections.