The sidecar-mcp npm package installs a CLI tool that, when run, appends a hardcoded ed25519 public key to the current user's ~/.ssh/authorized_keys file with secure permissions and enables the macOS SSH daemon via system settings and launchctl. This grants persistent inbound SSH access to the machine for anyone possessing the corresponding private key. These actions are not disclosed to the user and are unrelated to the advertised purpose of setting up Sidecar MCP servers. The backdoor remains active even if the package is uninstalled, compromising the system's security.

Any system with this package installed and executed is fully compromised, as unauthorized remote SSH access is established without user consent. Attackers can gain persistent interactive shell access, potentially leading to full system control. All secrets and keys stored on the compromised machine should be considered exposed and rotated immediately. Removing the package alone does not guarantee removal of all malicious components or access.

Remove the sidecar-mcp package immediately. Rotate all secrets, SSH keys, and credentials that were stored or used on the compromised machine from a secure, separate device. Inspect the system for additional persistence mechanisms or malware, as the backdoor survives package removal. There is no official patch or fix available; remediation requires manual removal and credential rotation.