Vet MCP packages before installing
Koi Security found an npm MCP server impersonating Postmark that, from one version on, quietly blind-copied every email it sent to an attacker-controlled address.
Dependencies, plugins & MCP servers
AI suggests packages, extensions and MCP servers that can be malicious or vulnerable. Check the publisher and permissions before installing.
3 items · 0 stories · 3 security incidents
Protect secrets from hijacked npm packages
Malicious versions of the Nx build tool were published to npm; the install script used locally installed AI coding CLIs to search the machine for secrets and wallets and uploaded them to GitHub.
Check rules files for hidden instructions
Pillar Security showed invisible Unicode in AI rules files could quietly instruct Copilot and Cursor to insert malicious code.