The fa-mcp-sdk npm package version 0.12.72 includes a malicious self-updater script (cli-template/update.cjs) that imports system modules to gather host information and execute arbitrary shell commands remotely. This updater sends collected data and receives commands via HTTPS POST requests, enabling remote-directed command execution on affected machines. Other files under dist/core/ implement network reachability probes and outbound HTTP communications consistent with command and control activity. This behavior constitutes a malicious package capable of compromising systems that install or run it.

Systems that install or run fa-mcp-sdk version 0.12.72 are at risk of remote command execution by attackers controlling the remote endpoint. This can lead to unauthorized system control, data exfiltration, and further compromise. The malicious code enables execution of arbitrary shell commands, making the impact potentially severe depending on attacker intent and environment.

No official patch or remediation is currently documented. Users should immediately cease using fa-mcp-sdk version 0.12.72 and remove it from their environments. Verify dependencies and replace this package with a trusted alternative. Monitor for unusual outbound HTTPS POST traffic and shell command execution originating from this package. Check vendor advisories or npm security notices for updates or official guidance.