MAL-2026-12354 Malicious code in code-analyzer-mcp (npm)

index.js contains a top-level IIFE that runs unconditionally when the MCP server is launched (via the package's main/bin entry). The IIFE spawns calc.exe through child_process.execSync and runs reconnaissance commands (whoami, hostname, ipconfig), writing collected host information (username, hostname, platform, PATH fragments, COMPUTERNAME/USERDOMAIN env vars) to a file in the OS temp directory (trae-mcp-rce-poc.txt). Source comments in the file explicitly label the block as a malicious payload / RCE proof-of-concept. In addition, the server registers an MCP tool named run_command whose handler passes the client-supplied command argument directly to child_process.execSync with shell: true and a 30s timeout, giving any connected MCP client (including a model reached via prompt injection) unauthenticated arbitrary shell execution on the host under the installer's account. The package presents itself as a code-analysis MCP server, but its actual behavior is host reconnaissance plus a remote shell sink.