AI supply-chain advisories

Two malicious builds of the Claude Code extension, versions 2.1.312 and 2.1.313, were served from Cursor's extension marketplace for about eleven hours on Oct 29. They sent host and user details to an attacker server, added an attacker SSH key to authorized_keys, and set up a persistent reverse SSH tunnel (a LaunchAgent on macOS, a scheduled task on Windows). Anthropic did not build them. Cursor's notice first named 2.1.313 alone and added 2.1.312 on Oct 30.

Updated Oct 31, 2026. Cursor's updated notice names a second malicious build, 2.1.312, and publishes hashes for all four packages and for the modified extension.js inside them. Cassandra now checks for both versions and all four packages, hashes the extension.js of an installed 2.1.312 or 2.1.313 so a genuine copy is told apart from the backdoored one, and looks beyond the notice: the tunnel process, cron entries, shell start-up files, persistence under other names (every user LaunchAgent, systemd unit and autostart entry), the tunnel key among your SSH keys, Windows Run keys and task actions, the attacker address inside any other extension's code, and the editor's install logs as a second history source.

Affected

anthropic.claude-code 2.1.312, 2.1.313 in Cursor

Window

Oct 29, 2026, 2:27 am to 1:35 pm Pacific

Network

134.209.82.225 (ports 8099, 22)

SSH key

svc-telemetrySHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htkSHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ

Persistence

com.apple.sysmondSysMon

Files

~/Library/LaunchAgents/com.apple.sysmond.plist~/.config/.smt~/.config/.smtk$TMPDIR/.stk_*/tmp/.stk_*%USERPROFILE%\.config\smt.cmd%USERPROFILE%\.config\smtk%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd%TEMP%\.stk_*

Packages

2.1.312 · darwin-arm64SHA-256fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364MD5e0d64d53e802a0217ba6f0e656ed2f202.1.312 · win32-x64SHA-2563de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081MD5bd3b71ddf3d0cc3af76249afd2c0eda12.1.313 · darwin-arm64SHA-25680402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6cMD534e491161e056c9b899a79b602ac73b92.1.313 · win32-x64SHA-2566786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731MD57838a3be2ca0ff08c1bdb160ef516d39

What to do

1. Run Cassandra on every machine that runs Cursor. It looks for this backdoor's SSH key, persistence and tunnel, and for both malicious versions.
2. If you ran Cassandra before Oct 31, run it again: the first notice named 2.1.313 alone, and the check now hashes the installed extension.js to tell a genuine copy from the backdoored one.
3. If Claude Code updated in Cursor during the window above, treat the machine as exposed: rotate its SSH keys, cloud and API credentials and Git tokens from a different machine.
4. Update Claude Code to 2.1.314 or later and restart Cursor.
5. Where traces are found, disconnect the machine and run Cursor's remediation script from the notice.

Release 1.12.14 carries malicious code; a machine that installed or ran it should be treated as fully compromised (GitHub advisory, October 2026).

Affected

@atlisp/mcp 1.12.14 (npm)

What to do

1. Remove @atlisp/mcp 1.12.14 from every MCP config and lockfile on every machine, and pin a release published after the compromise.
2. Treat everything it handled as exposed and rotate the credentials it was given, from a different machine.

Four extensions on Open VSX, the registry Cursor, Windsurf and VSCodium install from, copied the display names of the real Solidity and Hardhat tooling and inflated their download counts past the genuine listings. On activation each started a hidden Node process that unpacked payloads hidden inside a video file: a ScreenConnect remote-access client on Windows; on macOS and Linux a Go backdoor that takes its server address from an Ethereum contract and starts at every login through a LaunchAgent or a systemd user service. Pluto Security reported both waves and Open VSX removed each after about 19 hours; the second wave appeared within hours of the first takedown under new publisher accounts. Same operator as SleepyDuck (November 2025).

Affected

alejandroaranda.solidity-languini 0.9.2 (Open VSX)alejandroaranda.solidity-langsupport 0.0.6 (Open VSX)juanfranblanco.solidity-vscode 0.0.189, 0.0.190, 0.0.191 (Open VSX)Nomic-ETH.hardhat-solidity 0.9.2, 0.9.3 (Open VSX)

Window

Sep 24 to 26, 2026

Network

185.232.84.169:8041193.57.9.17:49120xf8a900Db50b3331be6B768bA460BB59f3E40C344 (Ethereum contract)

Persistence

~/Library/LaunchAgents/com.solidity.langsupport.runner.plist~/.config/systemd/user/solidity-langsupport-runner.serviceScreenConnect Client (5cbe79c9c25524df)

Files

~/.solidity/C:\Program Files (x86)\ScreenConnect Client (5cbe79c9c25524df)\

What to do

1. If any of these extensions was installed, disconnect the machine. Uninstalling the extension does not remove the backdoor; it runs outside the editor.
2. On macOS and Linux, look for ~/.solidity and the LaunchAgent or systemd user service above. On Windows, look for the ScreenConnect service. If any is present, rebuild the machine rather than clean it.
3. Rotate everything the machine could reach, wallet keys and contract deployment keys first, then SSH keys, cloud sessions and publishing tokens, from a different machine.
4. Install Solidity tooling from juanblanco.solidity and NomicFoundation.hardhat-solidity only, and read the publisher id, not the display name or the download count.

The four main AI coding agents pin a marketplace plugin to a reviewed commit hash, but none checked that the code that landed on disk matched it. An attacker who controls a plugin's repository can name a branch after the pinned hash (or FETCH_HEAD, for Gemini CLI) and the agent silently runs the branch instead of the reviewed commit. With plugin auto-update on by default in Claude Code and Codex, that needs no user action and runs with the developer's full permissions. Air Security reported it to the vendors in June 2026 and published on Sep 17, 2026. Anthropic and OpenAI shipped fixes; Microsoft had not fixed Copilot at disclosure, and Google will not fix Gemini CLI, which it has deprecated. No CVE was assigned.

Affected

Claude Code before 2.1.179Codex before 0.146.0GitHub Copilot (no fix at disclosure)Gemini CLI (deprecated; no fix planned)

Fixed in

Claude Code 2.1.179, Codex 0.146.0

What to do

1. Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later on every machine.
2. Where Copilot or Gemini CLI plugins are in use, turn off automatic plugin updates, so a swapped plugin at least needs a deliberate install.
3. List the plugins and marketplaces each agent has installed, and remove any whose source repository you do not trust to stay honest.

An npm package wearing the name of the official fetch MCP server, which is a Python package on PyPI; every version is malicious and a machine that installed it should be treated as fully compromised (GitHub advisory, August 2026).

Affected

mcp-server-fetch (npm)

What to do

1. Remove mcp-server-fetch from every MCP config on every machine.
2. Treat everything it handled as exposed and rotate the credentials it was given.

A threat actor took over the npm account atool and, in a 22-minute burst, published 631 malicious versions across 314 packages, among them three MCP servers that AI agents run to draw charts and diagrams: @antv/mcp-server-antv, mcp-echarts and mcp-mermaid. Each hijacked version adds a preinstall hook that runs a 498 KB obfuscated Bun script. It collects AWS keys, GitHub and npm tokens, GCP, Azure and Kubernetes credentials, SSH keys, Docker, database, Stripe and Slack secrets, and commits them to attacker-controlled GitHub repositories with Dune-themed names. It persists through a GitHub Actions workflow named Run Copilot that dumps the repository's secrets, hooks in AI agent sessions, and a daemon named kitty-monitor.

Affected

@antv/mcp-server-antv 0.2.8, 0.3.8 (npm)mcp-echarts 0.8.1, 0.9.1 (npm)mcp-mermaid 0.5.1, 0.6.1 (npm)

Persistence

GitHub Actions workflow "Run Copilot"daemon "kitty-monitor"

What to do

1. Search every MCP config (claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json) and every lockfile for these packages at these versions, and remove them.
2. On a machine that installed one, rotate every credential the user had: cloud keys, GitHub and npm tokens, SSH keys, database and payment secrets. Do it from a different machine.
3. Check the user's GitHub account for new public repositories and for a workflow you did not add, and delete both.
4. Pin exact versions in MCP configs, so the next hijacked release does not run on the next start.

TeamPCP's self-replicating worm compromised more than 170 npm and PyPI packages with over 518 million cumulative downloads, including the TanStack libraries, the Mistral AI SDKs, UiPath packages, Guardrails AI and the OpenSearch client, publishing through CI tokens leaked in build logs and over-permissive npm Trusted Publishing policies; the TanStack releases even carried valid build provenance. The payload reads 134 credential paths, among them ~/.claude.json and MCP server configs, and sends them out encrypted. It also commits two files into the repository: a SessionStart hook in .claude/settings.json that runs node .vscode/setup.mjs on every Claude Code session, and a folderOpen task in .vscode/tasks.json. Anyone who clones the repository and opens it re-runs the dropper, whether or not they ever installed an affected package. The commits are authored as claude@users.noreply.github.com with the message "chore: update dependencies". A first wave on Apr 29 and 30 hit SAP, Intercom and PyTorch Lightning packages.

Affected

@tanstack/* 84 artifacts across 42 packages (npm, CVE-2026-45321)@mistralai/* several versions (npm) and mistralai 2.4.6 (PyPI)@uipath/* 66 entries (npm)guardrails-ai 0.10.1 (PyPI)@opensearch-project/opensearch 3.5.3, 3.6.2, 3.7.0, 3.8.0 (npm)full list in the source

Network

git-tanstack.com83.142.209.194

Files

.claude/settings.json (SessionStart hook running node .vscode/setup.mjs).vscode/tasks.json (runOn: folderOpen task).vscode/setup.mjs

GitHub

commits by claude@users.noreply.github.com, "chore: update dependencies"new public repositories described "Shai-Hulud: Here We Go Again"

What to do

1. Search every repository, including clones on developer machines, for .vscode/setup.mjs, a SessionStart hook in .claude/settings.json and a folderOpen task in .vscode/tasks.json you did not write. Remove them and the commit that added them.
2. If an affected version was installed, rotate npm, GitHub and cloud credentials from a different machine, and delete the public repositories the worm created on the account.
3. Restrict npm Trusted Publishing to the release workflow on a protected branch, and drop pull_request_target workflows that can see secrets.
4. Pin dependencies and review lockfile changes; the worm ships as ordinary patch releases.

In its fifth wave GlassWorm moved into MCP servers. @iflow-mcp/watercrawl-watercrawl-mcp, a copy of the WaterCrawl MCP server published under a look-alike npm scope, carried the campaign's invisible-Unicode payload in all five versions, published on Mar 12, 2026 within 26 minutes. The same payload appeared in @aifabrix/miso-client 4.7.2, clean until that release, in the quartz-markdown-editor VS Code extension 0.3.0, and in more than 150 GitHub repositories pushed between Mar 3 and 9. The decoded payload reads its server address from Solana transaction memos on the wallet the campaign has used since October 2025 and downloads a second stage that steals tokens, credentials and secrets. An MCP server is handed credentials by design, which is what the wave was after.

Affected

@iflow-mcp/watercrawl-watercrawl-mcp 1.3.0 to 1.3.4 (npm)@aifabrix/miso-client 4.7.2 (npm)quartz.quartz-markdown-editor 0.3.0 (VS Code Marketplace)

Network

BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC (Solana wallet)

What to do

1. Search MCP configs (claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json) and lockfiles for @iflow-mcp/watercrawl-watercrawl-mcp and @aifabrix/miso-client 4.7.2, and remove them. The real WaterCrawl server is @watercrawl/mcp.
2. Remove quartz-markdown-editor 0.3.0 from VS Code.
3. Where one ran, rotate every token and credential the agent and the user had, from a different machine.
4. Read the full package name before adding an MCP server, pin its version, and compare a file's byte count with its visible code: GlassWorm hides thousands of invisible characters at the end of a normal-looking file.

On Jan 30, 2026 four long-standing Open VSX extensions by the publisher oorzc, with more than 22,000 downloads between them, got new versions carrying the GlassWorm loader, consistent with a leaked publishing token. The loader decrypts and runs an embedded blob at activation, skips Russian-locale systems, reads its next stage from Solana transaction memos and runs it in memory. The macOS payload stages copies of browser cookies and login databases, wallet extensions and desktop wallets, the login keychain, Apple Notes, Safari cookies, documents, ~/.aws, ~/.ssh, the npm _authToken and GitHub credentials under /tmp/ijewf, zips them to /tmp/out.zip, sends them out, and installs a LaunchAgent so it runs at every login. Open VSX deactivated the publisher's tokens and removed the malicious releases; every version of oorzc.ssh-tools was removed.

Affected

oorzc.ssh-tools 0.5.1 (Open VSX; all versions since removed)oorzc.i18n-tools-plus 1.6.8 (Open VSX)oorzc.mind-map 1.0.61 (Open VSX)oorzc.scss-to-css-compile 1.3.4 (Open VSX)

Persistence

~/Library/LaunchAgents/com.user.nodestart.plist

Files

/tmp/ijewf/tmp/out.zip

What to do

1. If any of these versions was installed, treat it as a credential exposure. Remove the extension and its files, and on macOS look under ~/Library/LaunchAgents for a plist you did not create, such as com.user.nodestart.plist, and for /tmp/ijewf or /tmp/out.zip.
2. Rotate the user's AWS, SSH, npm, GitHub and browser-saved credentials and move wallet funds, from a different machine.
3. Earlier versions of the other three extensions are clean; update only once the publisher has confirmed the account is recovered.

Two Chrome Web Store extensions posing as AI sidebars, one of them carrying Google's Featured badge, read every ChatGPT and DeepSeek conversation on the page, prompts and answers, and every URL open in the browser, store them locally and send them to attacker servers every 30 minutes. They ask for consent to "anonymous, non-identifiable analytics data" and copy the look of the legitimate AITOPIA sidebar. Uninstalling one opens the other's store page. OX Security reported both to Google on Dec 29, 2025; Microsoft later saw the extensions across more than 20,000 enterprise tenants. For a developer, that is source code, keys and internal URLs pasted into a chat, leaving the browser.

Affected

Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI 1.9.6 (fnmihdojmnkclgjpcoonokmkhjpjechg)AI Sidebar with Deepseek, ChatGPT, Claude and more 1.6.1 (inhcgfpbfdjbjogdfjbclgolkmhnooop)

Network

deepaichats.comchatsaigpt.comchataigpt.prochatgptsidebar.pro

Hashes

98d1f151872c27d0abae3887f7d6cb6e4ce29e99ad827cb077e1232bc4a69c00 (fnmihdojmnkclgjpcoonokmkhjpjechg 1.9.6)20ba72e91d7685926c8c1c5b4646616fa9d769e32c1bc4e9f15dddaf3429cea7 (inhcgfpbfdjbjogdfjbclgolkmhnooop 1.6.1)

What to do

1. Open chrome://extensions (or edge://extensions) and remove both extensions by id. Do not follow the page that opens on uninstall.
2. Treat everything pasted into ChatGPT or DeepSeek from that browser as disclosed: code, keys, customer data. Rotate any secret that was in a conversation.
3. Block the four domains above at the network edge and look for past connections to them.
4. Allow AI browser extensions by id, not by store badge or install count.

The campaign resumed on Nov 22, 2025 with a new delivery. Instead of invisible Unicode, each extension ships a few dozen lines of JavaScript that load a compiled 2.4 MB Node addon (darwin.node on macOS, os.node on Windows), which fetches its server address from the Solana blockchain, downloads AES-encrypted payloads and falls back to Google Calendar entries. Thirty-four listings across both marketplaces impersonated popular tools: icon themes, clangd, Prettier, Prisma, Vim, Svelte, Flutter, Solidity, and Claude Code look-alikes such as saoudrizvsce.claude-dev. Several started as working extensions and turned into a loader in an update once they had installs. All were taken down.

Affected

Open VSX: bphpburn.icons-vscode, clangdcode.clangd-vscode, csvmech.csv-sql-tsv-rainbow, cweijamysq.sync-settings-vscode, eamodas.shiny-vscode, flutcode.flutter-extension, iconkief.icon-theme-material, msjsdreact.react-native-vscode, saoudrizvsce.claude-dev, saoudrizvsce.claude-devsce, solblanco.svelte-vscode, svltsweet.svetle-for-cursor, tailwind-nuxt.tailwindcss-for-react, vitalik.solidity, yamlcode.yaml-vscode-extensionVS Code Marketplace: bphpburnsus.iconesvscode 12.15.1 and 12.15.2, iconkieftwo.icon-theme-materiall, clangdcode.clangd-vsce, codevsce.codelddb-vscode, csvmech.csvrainbow, cweijamysq.sync-settings-vscode, dart-vsc.code-dart, flutcode.flutter-extension, klustfix.kluster-code-verify, lyywemhan.code-formatter-and-minifier-vscode, msjsdreact.react-native-vsce, prettier-vsc.vsce-prettier, prisma-inc.prisma-studio-assistance, redmat.vscode-quarkus-pro, saoudrizvsce.claude-devsce, solblanco.svetle-vsce, vims-vsce.vscode-vim, vsceue.volar-vscode, yamlcode.yaml-vscode-extension

Window

From Nov 22, 2025

Network

217.69.13.22945.76.45.15145.32.151.157107.191.62.170104.238.191.54 (exfiltration)108.61.208.161 (exfiltration)

Loader hashes

026873b940176d103d45b41c9fba73f14cfcaca60e3117be81d2eadef85a4d17 (darwin.node)9bd105ce732218f30719fd69d4555967b362d37f4f6aec04741c18aaa7411a73 (darwin.node)fb07743d139f72fca4616b01308f1f705f02fda72988027bc68e9316655eadda (darwin.node)cbb3f830731fe2c9194f7fe5aa55479cffdae184039b0df078b1394209d7a49f (os.node)29875e74f033c819c1acab58ef08bc35646aab5f4a2747ee0933ca41150d7099 (os.node)6ebeb188f3cc3b647c4460c0b8e41b75d057747c662f4cd7912d77deaccfd2f2 (os.node)

What to do

1. Remove any extension above and look in its folder under ~/.vscode/extensions or ~/.cursor/extensions for darwin.node or os.node; the extension's own JavaScript is only a few dozen lines.
2. Where a loader ran, rotate GitHub, npm, Git and cloud credentials and move wallet funds, from a different machine.
3. Install icon themes, formatters and language tools from their known publishers, and treat an update that shrinks an extension to a loader as the warning it is.
4. Block the addresses above at the network edge and look for past connections to them.

Starting Nov 24, 2025 a second Shai-Hulud worm published malicious versions of about 800 npm packages, over 1,000 versions in all, including Zapier's platform SDK, PostHog's posthog-js, ENS, AsyncAPI, CrowdStrike and Postman packages. A preinstall script (setup_bun.js) installs the Bun runtime and runs bun_environment.js, which steals npm and GitHub tokens, cloud credentials and environment secrets, publishes them in new public GitHub repositories on the victim's account, adds a GitHub Actions workflow and uses the stolen npm token to push the same payload into the victim's own packages. Fifteen MCP-related packages were among those hijacked, so an AI agent configured with an unpinned one would have fetched the malicious release on its next start.

Affected

@postman/postman-mcp-server 2.4.10, 2.4.12 (npm)@postman/postman-mcp-cli 1.0.3, 1.0.4, 1.0.5 (npm)@zapier/mcp-integration 3.0.1, 3.0.2, 3.0.3 (npm)mcp-use 1.4.2, 1.4.3 and @mcp-use/mcp-use 1.0.1, 1.0.2 (npm)@relyt/claude-context-mcp 0.1.1, @seezo/sdr-mcp-server 0.0.5, lite-serper-mcp-server 0.2.2, web-scraper-mcp 1.1.4, mcp-knowledge-base 0.0.2, mcp-knowledge-graph 1.2.1 (npm)zapier-platform-core 18.0.2 to 18.0.4, posthog-js 1.297.3, @asyncapi/cli 4.1.2, 4.1.3 (npm)full list in the source

Files

setup_bun.jsbun_environment.js

GitHub

new public repositories described "Sha1-Hulud: The Second Coming"

What to do

1. Search lockfiles and node_modules on developer machines and CI for the affected versions; remove them and install a clean release.
2. If one was installed, rotate npm, GitHub and cloud credentials from a different machine, and delete the public repositories and the workflow the worm added to the account.
3. Pin MCP server versions in agent configs; an unpinned npx launch fetches whatever is latest.
4. Require 2FA for npm publishing and turn off install scripts in CI where you can (npm config set ignore-scripts true).

Sixteen days after Open VSX declared the first GlassWorm incident contained, three more extensions on the registry carried the same invisible-Unicode payload: code encoded in unprintable characters that an editor shows as blank space and the JavaScript engine runs. A fresh Solana transaction gave infected machines a new download address while the exfiltration server from October stayed in place. About 10,000 downloads between them. Researchers who reached the attacker's server found a partial victim list spanning the US, South America, Europe and Asia, including a government entity in the Middle East.

Affected

ai-driven-dev.ai-driven-dev 0.4.11 (Open VSX)adhamu.history-in-sublime-merge 1.3.4 (Open VSX)yasuyuky.transient-emacs 0.23.1 (Open VSX)

Network

199.247.10.166199.247.13.106 (exfiltration)

What to do

1. Remove these versions from every Cursor, Windsurf, VSCodium or VS Code install; the publishers' later releases are clean.
2. Where one ran, rotate GitHub, npm and Git credentials and move wallet funds, from a different machine.
3. Block the addresses above and look for past connections to them.

juan-bianco.solidity-vlang, named after the real Solidity extension by juanblanco, went up on Open VSX on Oct 31, 2025 as a harmless package, reached 14,000 downloads, turned malicious with the next day's update and passed 53,000 downloads by Nov 2. It activates on editor start, when a Solidity file opens or on compile, collects hostname, username, MAC address and timezone, and polls a command server for commands to run. If sleepyduck.xyz is taken down it reads a new server address from an Ethereum smart contract. Secure Annex reported it; the same operator came back with EtherDuck in September 2026.

Affected

juan-bianco.solidity-vlang up to 0.1.3 (Open VSX)

Network

sleepyduck.xyz

What to do

1. Remove the extension from every Cursor, Windsurf or VSCodium install; the real extension is juanblanco.solidity.
2. Where it ran, treat the machine as remotely controlled: rotate wallet keys, SSH keys and cloud credentials from a different machine.
3. Block sleepyduck.xyz and look for past connections to it.

Starting Oct 17, 2025, eleven extensions on Open VSX and one on the VS Code Marketplace carried malicious code hidden in invisible Unicode characters, so the file looked unchanged in an editor. Extensions auto-update, so everyone with CodeJoy installed got the infected 1.8.3 without a click. The payload steals npm, GitHub, Git and Open VSX credentials and the data of 49 cryptocurrency wallet extensions, installs a SOCKS proxy and a hidden VNC server, and uses the stolen tokens to infect the extensions and packages the victim can publish. Its download addresses come from Solana transactions, with a Google Calendar event as fallback. About 35,800 installs. Open VSX rotated tokens and declared the incident contained on Oct 21.

Affected

codejoy.codejoy-vscode-extension 1.8.3, 1.8.4 (Open VSX)l-igh-t.vscode-theme-seti-folder 1.2.3 (Open VSX)kleinesfilmroellchen.serenity-dsl-syntaxhighlight 0.3.2 (Open VSX)JScearcy.rust-doc-viewer 4.2.1 (Open VSX)SIRILMP.dark-theme-sm 3.11.4 (Open VSX)CodeInKlingon.git-worktree-menu 1.0.9, 1.0.91 (Open VSX)ginfuru.better-nunjucks 0.3.2 (Open VSX)ellacrity.recoil 0.7.4 (Open VSX)grrrck.positron-plus-1-e 0.0.71 (Open VSX)jeronimoekerdt.color-picker-universal 2.8.91 (Open VSX)srcery-colors.srcery-colors 0.3.9 (Open VSX)cline-ai-main.cline-ai-agent 3.1.3 (VS Code Marketplace)

Window

Oct 17 to 21, 2025

Network

217.69.3.218

What to do

1. Remove these versions from every Cursor, Windsurf, VSCodium or VS Code install. vscode-theme-seti-folder and git-worktree-menu were cleaned by their publishers; update them.
2. Where one ran, rotate GitHub, npm, Git and Open VSX tokens and move wallet funds, from a different machine, and check the packages and extensions you publish for versions you did not release.
3. Look for a SOCKS proxy or VNC server you did not install, and block the address above.

Impersonates Postmark's MCP server; from version 1.0.16 it copies every email it sends to an outside address (reported by Koi Security, September 2025).

Affected

postmark-mcp (npm)

What to do

1. Remove postmark-mcp from every MCP config on every machine.
2. Treat everything it handled as exposed and rotate the credentials it was given.

A malicious remote MCP server can run commands on the machine through the OAuth flow.

Affected

mcp-remote <0.1.16 (npm)

Fixed in

0.1.16

What to do

1. Upgrade mcp-remote to 0.1.16 or later.
2. Pin exact versions in MCP configs, so a new release never runs unreviewed.

Symlink and path-prefix checks can be bypassed to read and write outside the allowed directories.

Affected

@modelcontextprotocol/server-filesystem <0.6.3, >=2025.0.0 <2025.7.1 (npm)

Fixed in

2025.7.1

What to do

1. Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later.
2. Pin exact versions in MCP configs, so a new release never runs unreviewed.

Unauthenticated inspector proxy lets a website run commands on the machine.

Affected

@modelcontextprotocol/inspector <0.14.1 (npm)

Fixed in

0.14.1

What to do

1. Upgrade @modelcontextprotocol/inspector to 0.14.1 or later.
2. Pin exact versions in MCP configs, so a new release never runs unreviewed.