Malicious code in @aster110/cc2wechat (npm)

Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body into a locally hosted AI agent that is spawned with all...

Malicious code in sensorium-mcp (npm)

Source: amazon-inspector 73c4ac95caf91cb047bab32d5202efa2dfc2e4f84a032160419a7c30739da91c sensorium-mcp starts a background poller against api.telegram.org/getUpdates and delivers received message text as prompts to locally spawned Claude Code invoked with --dangerously-skip-permissions and Codex...