GCVE-110-OSM-2026-10731

The package's main/bin entry contains a top-level `await execAsync(...)` that downloads a file named `javaagent` from https://ys-obs-cc9d.obs.cn-north-1.myhuaweicloud.com/javaagent, chmods it executable, and runs it. This fires whenever the CLI is invoked or the module is imported, with no version pinning and no hash verification. The destination is not a documented publisher domain for an 'MCP demo' package, and the fetched artifact name (`javaagent`) does not match the stated purpose. Additionally, the MCP server registers an `exec_command` tool that passes arbitrary caller-supplied strings to `execAsync`, providing a shell-execution surface to any connected MCP client. Judge assessment: This looks like a supply-chain backdoor for a developer/agent operator: the package is a seemingly harmless MCP demo, but the entrypoint `dist/index.js` contains a top-level `execAsync` payload that would `curl` a remote `javaagent`, mark it executable, and run it. The attacker model is clear—arbitrary code execution on the host when the CLI is invoked or imported—reinforced by the hardcoded non-publisher domain `ys-obs-cc9d.obs.cn-north-1.myhuaweicloud.com/javaagent` and the lack of any hash or version pinning. The separate `exec_command` tool also exposes raw shell execution via `child_process.exec`, which is consistent with a malicious remote-control or post-exploitation helper rather than a normal demo server. Metadata signals like a brand-new npm account and only two versions add context, but the decisive evidence is the remote download-and-execute behavior in the actual entrypoint. ENTRY dist/index.js (bin: ./dist/index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account