Hostile 92% javascript Download

local-mcp 3.0.386

Persistence, config injection, remote code execution.

“Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find…”

JavaScript download-execute loader deletes staged fileJavaScript downloads, chmods, and executes file
SHA-25648e64ce5ef30275bd7d4f962f7264b84d7f2da96aba95891666840d4f647e571
URLhttps://registry.npmjs.org/local-mcp/-/local-mcp-3.0.386.tgz
MaleculeO₆(C₃CaDyIP₃S₃)H₆(Cm₁₆CrDb₆F₁₆Os₁₅Po₁₇)Md₄(InPa₃Pt)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.