Skip to content

Back to the catalog

securityboulevard.comarticle

973 MCP Packages, 71% Single-Maintainer: A Practitioner

Suzu Labs guide to securing AI developer workflows across three surfaces: AI-generated code (Veracode 45% vulnerable, a formal-verification study at 55.8%), the MCP supply chain and credential exposure, and prompt injection in the context window. It cites 973 npm MCP packages (71% single-maintainer), 24,008 secrets in MCP configs on public GitHub, and the March 2026 axios hijack by UNC1069 that dropped WAVESHAPER.V2 and tampered with MCP configs. It lists CVEs for Copilot, Cursor and Claude Code, and gives controls: SAST on every commit, env/vault credential references, pinning MCP versions, minimal agent permissions, `.cursorignore`/Claude deny rules, and monitoring IDE DNS traffic.

TL;DR Practitioner guide to AI coding tool risk: MCP supply-chain immaturity, plaintext MCP config secrets, prompt-injection CVEs in Cursor/Copilot/Claude Code, with controls for each.
Open original ↗

Organisations named here

  • WAVESHAPER.V2

CVEs named here

  • CVE-2025-53773
  • CVE-2026-22708
  • CVE-2025-55284
  • CVE-2025-54135

Technologies named here

  • GitHub Copilot
  • Semgrep
  • CodeQL
  • Cursor IDE
  • Snyk
  • Claude Code
  • AWS Kiro
  • 1Password CLI
  • Google Jules
  • HashiCorp Vault
  • MCP servers/packages on npm
  • AWS Secrets Manager
  • MCP STDIO transport
  • GitHub Secret Scanning and Push Protection
  • MCP config files storing plaintext credentials
  • GitHub MCP Server
  • 11 MCP registries tested by OX Security
  • EDR tools
  • Axios npm package
  • Cursor .cursorignore
  • Claude Code .claude/settings.json deny patterns
  • Windsurf
  • Veracode Spring 2026 GenAI Code Security Report
  • VS Code Continue
  • Formal verification study published April 2026
  • Armis Trusted Vibing Benchmark
  • GitGuardian 2026 State of Secrets Sprawl report
  • OX Security MCP registry testing
  • Lorikeet Security analysis of WAVESHAPER campaign
  • Model Context Protocol
  • npm
  • Cursor
  • axios
  • Veracode
  • GitGuardian
  • OX Security

Techniques named here

  • Prompt injection against AI coding assistants
  • DNS exfiltration encoding stolen data in subdomain lookups
  • Software supply chain compromise via hijacked npm package
  • Malicious MCP server upload to registries
  • Credential harvesting via unrestricted outbound connectivity
  • Prompt Injection

Threat actors named here

  • UNC1069
  • WAVESHAPER campaign
  • CurXecute
  • DPRK

Related in AI Security