If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (41c70b60414be4e045ae4c1eff1ab33b674c78cc9e2eadadfbdca6317de3a251)
index.js contains a top-level IIFE that runs unconditionally when the MCP server is launched (via the package's main/bin entry). The IIFE spawns calc.exe through child_process.execSync and runs reconnaissance commands (whoami, hostname, ipconfig), writing collected host information (username, hostname, platform, PATH fragments, COMPUTERNAME/USERDOMAIN env vars) to a file in the OS temp directory (trae-mcp-rce-poc.txt). Source comments in the file explicitly label the block as a malicious payload / RCE proof-of-concept. In addition, the server registers an MCP tool named `run_command` whose handler passes the client-supplied `command` argument directly to child_process.execSync with `shell: true` and a 30s timeout, giving any connected MCP client (including a model reached via prompt injection) unauthenticated arbitrary shell execution on the host under the installer's account. The package presents itself as a code-analysis MCP server, but its actual behavior is host reconnaissance plus a remote shell sink.