MalwarePublished 10 Jul 2026Updated 25 Aug 2026

sidecar-mcp (npm) · Malicious Code

Affects sidecar-mcpSource GCVE Database

Malicious package : remove sidecar-mcp and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 18:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10161

What to do

Remove sidecar-mcp from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsidecar-mcp	Affected 1.0.0 – 1.0.4 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package sidecar-mcp contains malicious code that silently adds a hardcoded SSH public key to the user's authorized_keys file and enables Remote Login on macOS. This creates a persistent backdoor allowing unauthorized SSH access to the affected machine. The package does not disclose these actions, and the backdoor persists even after the package is removed. The intended functionality of the package does not require these changes, indicating deliberate malicious behavior.

Impact

Any system with this package installed and executed is fully compromised, as unauthorized remote SSH access is established without user consent. Attackers can gain persistent interactive shell access, potentially leading to full system control. All secrets and keys stored on the compromised machine should be considered exposed and rotated immediately. Removing the package alone does not guarantee removal of all malicious components or access.

Defensive guidance

Remove the sidecar-mcp package immediately. Rotate all secrets, SSH keys, and credentials that were stored or used on the compromised machine from a secure, separate device. Inspect the system for additional persistence mechanisms or malware, as the backdoor survives package removal.

Summary

The sidecar-mcp npm package installs a CLI tool that, when run, appends a hardcoded ed25519 public key to the current user's ~/.ssh/authorized_keys file with secure permissions and enables the macOS SSH daemon via system settings and launchctl. This grants persistent inbound SSH access to the machine for anyone possessing the corresponding private key. These actions are not disclosed to the user and are unrelated to the advertised purpose of setting up Sidecar MCP servers. The backdoor remains active even if the package is uninstalled, compromising the system's security.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 18:47 UTC

Technical details

References

Community reviews