⚠ Risky-Tool Advisory Analyzed codelake triage · 2026-10-21
A security-hygiene observation, not a malware finding. This advisory documents dangerous security practices in a legitimate-purpose tool — for example transmitting credentials over plaintext HTTP, heavy code obfuscation, or automatic global installs. It is not a claim of theft, backdoor or malicious intent: the tool does what it advertises, and the risk falls on its own users and their data. It is published so operators can make an informed decision before installing or deploying it.
Advisory · CLR-2026-3672

A self-declared dual-use MCP tool that syncs IDE AI-conversation records to the user's own vendor cloud account, shipped deliberately obfuscated

@bangdao-ai/acw-tools (“ACW Tools”, by Bangdao Technology) is a Model-Context-Protocol tool for Cursor and Codex that downloads company rules/skills/knowledge and, while the MCP server runs, reads the IDE's AI-conversation store and syncs conversation records plus host telemetry to a vendor backend (default acw.bangdao-tech.com) on a background schedule. Uploads are authenticated with a user-provided ACW_TOKEN and go to the user's own ACW account. The package is deliberately obfuscated (javascript-obfuscator) and ships a DISCLOSURE file declaring itself dual-use. This is not malware — there is no install hook, no credential theft and no third-party exfiltration — but an obfuscated package that uploads developers' AI-session transcripts to a cloud service is a privacy/supply-chain consideration worth surfacing.

MediumRisky toolDual-use (self-declared)AI-transcript cloud syncDeliberately obfuscatedUser-token gatedNo install hookNo credential theft
Summary

@bangdao-ai/acw-tools version 1.13.79 (npm) is a commercial MCP integration for the ACW (AI Collaborative Workbench) platform. It installs rules, skills and knowledge into a Cursor/Codex workspace and, as a core product feature, synchronises AI-collaboration records to the ACW backend for team analytics.

codelake independently flagged this release during routine supply-chain triage because it combines deliberate code obfuscation with reads of local IDE conversation data and scheduled cloud upload — a combination automated scanners reasonably treat as suspicious. On flag-safe static review the behaviour matches the vendor's own published declaration, so this is recorded as a Risky tool, not malware.

Why this is Risky, not Malware

Read statically (no execution): the package has no install hook (its only npm scripts are test/start/release), so merely installing it executes nothing. All network traffic goes to a single user-configured host ACW_BASE_URL (default acw.bangdao-tech.com) over endpoints under /api/mcp/ (skills, rules, knowledge/upload, telemetry/upload), authenticated with the user's own ACW_TOKEN. There is no hardcoded or third-party exfiltration host.

It reads the Cursor conversation key-value store and non-credential account metadata; codelake found no harvesting of credentials — no keytar, login/access tokens, SSH keys, .npmrc, browser cookies or private keys. The execFileSync calls are git-remote lookups and parser child-processes. The package ships a DISCLOSURE file that openly declares it as dual-use, states the obfuscation is first-party IP protection, and documents the transcript sync.

What earns the Risky classification is the combination of deliberate obfuscation and background upload of developers' AI-session transcripts and host telemetry to a cloud service. The behaviour is consensual and user-token-gated, and the vendor discloses it — but because the code is obfuscated, users cannot independently audit exactly what is sent. This advisory records an independent detection and the trust/privacy posture; it does not claim credential theft, a backdoor or covert exfiltration, none of which were found.

Indicators & characteristics
PKG@bangdao-ai/acw-tools — npm, v1.13.79 (bin: acw-tools; Bangdao Technology)
HOSTACW_BASE_URL (default https://acw.bangdao-tech.com) — user-configured vendor backend
API/api/mcp/{skills,rules,knowledge/upload,telemetry/upload-log} — authed with user ACW_TOKEN
DATAreads Cursor cursorDiskKV conversation store + host telemetry; uploads on a setInterval schedule while the MCP server runs
CODEobfuscator.io obfuscation across parser modules; ships javascript-obfuscator; self-declared in a DISCLOSURE file
NEGno install hook; no credential/secret harvesting; no third-party or hardcoded exfil host
Response & guidance
#ActionPriority
01 Know that your AI-session transcripts leave the machine. While the MCP server runs, conversation records and host telemetry are uploaded to your configured ACW account. Only enable it where that data flow is acceptable (e.g. sanctioned enterprise use). Warning
02 Treat obfuscation as reduced auditability. Because the package is obfuscated, you are trusting the vendor's disclosure rather than code you can read. Review the shipped DISCLOSURE and the vendor's data policy before granting it access. Caution
03 Vendor guidance: publishing unobfuscated source (or a reproducible build) for the data-handling paths would let users verify the disclosed behaviour and remove the main reason scanners flag the package. Fix

Analyzed independently by codelake Research · AI-assisted triage + deterministic static code review (no execution). Classified Risky tool: a self-declared dual-use commercial tool whose obfuscation and AI-transcript cloud sync are a privacy/auditability consideration — not malware. codelake stores only the detection rule, indicators and analysis, never raw payloads.