Case mcp-server-npm-typosquatsAI supply chainWorldwide
Typosquatted npm MCP servers phone home on install posing as official modelcontextprotocol packages
Unscoped packages such as mcp-server-sequential-thinking, mcp-server-github, mcp-server-git and mcp-server-figma mimicked official MCP servers and sent hostname, working directory and platform data to a Cloudflare Workers endpoint on install.
LowAttack on AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 9, 2026
- Location
- Worldwide
- Target
- Developers installing MCP servers via npx
- Severity
- Low
- Triggered by
- Unknown (self-described canary research)
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Unscoped packages such as mcp-server-sequential-thinking, mcp-server-github, mcp-server-git and mcp-server-figma mimicked official MCP servers and sent hostname, working directory and platform data to a Cloudflare Workers endpoint on install.
Impact: Host identifiers leaked from any machine that installed or ran the packages; no credential theft documented
Who triggered it
Actor: Unknown (self-described canary research)
Attribution: Author's README framed the packages as canary research; reported by Amazon Inspector and ReversingLabs and recorded as malicious by OpenSSF
Motive: Stated as research; behaviour matched reconnaissance of developer machines without consent
How it happened
Attack vector: Unscoped package names developers and AI agents call via npx; postinstall hook and bin entry both execute index.js
Root cause: Name confusion between scoped official MCP packages and unscoped lookalikes; automatic install-time script execution
Timeline
- MAL-2026-5484 and sibling advisories published for the typosquatted MCP packages
- Advisory last updated
Response
OSV advised treating affected machines as compromised and rotating secrets; packages flagged in the OpenSSF malicious-packages repository
Current status: Resolved
Sources (open in a new tab)
- OSV MAL-2026-5484 osv.dev
- OSV MAL-2026-5479 osv.dev
Cite this case
Typosquatted npm MCP servers phone home on install posing as official modelcontextprotocol packages. AI Threat Watch, case mcp-server-npm-typosquats, Jun 9, 2026. https://aithreat.io/cases/mcp-server-npm-typosquats/
Permanent link: https://aithreat.io/cases/mcp-server-npm-typosquats/