DeepSweep security advisory DS-2026-001: @deepsweepai/mcp-firewall has ten security issues and is retired with no fix

DeepSweep published security advisory DS-2026-001, announcing that its npm package @deepsweepai/mcp-firewall is being retired directly due to ten security issues, with no fix version to be provided. The package's only released version, 0.1.0, is affected, with the highest severity being High (CVSS 3.1 7.5). Three High issues include caller identity taken from the unvalidated request header X-Client-ID, LangChain, CrewAI, and AutoGen wrapper paths continuing execution after interception, and credential detection missing formats such as cloud keys. The advisory recommends that users remove the package, and before removal, check ./logs/ for credentials recorded in fields named apiKey and rotate keys. Researcher Vasanthadithya M privately reported these issues.