MCP-006 Known-compromised MCP server release

An MCP server entry pins a registry package whose (ecosystem, name, version) matches a catalogued supply-chain incident. Whatever the malicious release does runs inside your AI client's host, with its reach. The catalog is the same one used by the SUP-COMPROMISE rules and EXT-001.

What Vulkro detects

command is npx (looked up as npm) or uvx (looked up as pypi),
the first positional argument is a registry package spec (not a local path or git URL), and
its (name, version) matches a row in the compromised-release catalog.

Severity Critical, confidence High. Evidence signal: mcp-server-compromised-release, weight 0.9, source Context. The finding cites the incident ID and the first advisory URL.

The catalog refreshes through the signed update bundle (vulkro update); a baked-in copy covers fresh and offline installs.

Non-compliant code

ua-parser-js@0.7.29 is from the 2021 maintainer-account hijack; ctx==0.2.2 is the 2022 PyPI release that exfiltrated AWS credentials.

{
  "mcpServers": {
    "evil-ua-parser": { "command": "npx", "args": ["ua-parser-js@0.7.29"] },
    "evil-ctx": { "command": "uvx", "args": ["ctx==0.2.2"] }
  }
}

Compliant code

{
  "mcpServers": {
    "ua-parser": { "command": "npx", "args": ["ua-parser-js@1.0.40"] }
  }
}

How to fix

Pin a clean release from before the compromise window or after the upstream fix; the advisory URL in the finding gives the affected range. If none exists, remove the dependency or vendor it from a known-good source.
Audit build artefacts produced while the bad version was resolved.
Rotate credentials the host could see while it was active.
Run vulkro respond to find the same (name, version) in your other projects.

What Vulkro detects​

Non-compliant code​

Compliant code​

How to fix​

References​

What Vulkro detects

Non-compliant code

Compliant code

How to fix

References