GCSA warns that MCP packages have been squatted by third parties

1. 18:03
   X@CobaltHere· Discussion

   6/10 Bitkub's MCP package name now has a different npm publisher. Its latest version has no executable. The old inst…(opens the original post in a new tab)
2. 12:15
   X @MinLiBuilds

   GCSA warns that MCP packages have been squatted by third parties, and AI coding projects may face supply chain poisoning

   GCSA warns that MCP packages have been squatted by third parties and may be used for supply chain poisoning and stealing API keys; its GCSA Agent achieved a 91.3% success rate on the CyberGym Level 1 real software codebase evaluation. For Claude Code and Codex developers, it recommends using sandboxes, least privilege, and MCP auditing, and rotating keys and rolling back code afterward.

3. 03:44
   X@lxfater· Discussion

   You're still using AI to write code like crazy, while others are already using AI to automatically reverse engineer your code and products!! Nowadays people use Claude Code and Codex to spin up several sites a day; you think your project is small so hackers won't look at it? But reverse engineering and finding vulnerabilities no longer rely on manual work—AI can go through code and find hidden issues itself…(opens the original post in a new tab)

1. 21:43
   X@happy20250912· Discussion

   @hezhiyan7 Supply chain control in the MCP ecosystem is clearly insufficient at present; after the official takedown, the package name was squatted on + there is a package under the same account that exports environment variables, which already constitutes a real risk.(opens the original post in a new tab)
2. 21:34
   X@hezhiyan7· Discussion

   Right now MCP is really quite convenient to use, but the risk of being poisoned is still quite high. Watching the drama: an investigation by GCSA: Bitkub's official documentation teaches everyone to install their trading MCP with claude mcp add + npx -y, with the API Key written directly into the launch parameters, and no version locking either…(opens the original post in a new tab)

Current attention 9·Peak in the comparable period 14 (Nov 7 13:00)·Change over the comparable past 24 hours 0%