Vet MCP packages before installing
Koi Security found an npm MCP server impersonating Postmark that, from one version on, quietly blind-copied every email it sent to an attacker-controlled address.
npm: real stories
2 items
Protect secrets from hijacked npm packages
Malicious versions of the Nx build tool were published to npm; the install script used locally installed AI coding CLIs to search the machine for secrets and wallets and uploaded them to GitHub.