Poisoned Pipeline / Platforms / MCP
MCP
10 mapped incident(s) that touched this platform or registry.
Apex Accelerator published a malicious npm coding agent and a fake audit MCP
npmmacOS softwareWindows softwareMCPAI coding agentsGit / GitHubVS Code / IDEDeveloper workstation
7 mapped techniques
Azazel harvested GitLab CI secrets and called a local MCP tool on a victim
GitLabGitLab CIGit / GitHubJenkinsMCPAI coding agentsLinux distro / packagesAWSKubernetes
6 mapped techniques
testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
npmPyPIRubyGemsGit / GitHubGitLabGitHub ActionsDeveloper workstationAI coding agentsMCPVS Code / IDELinux distro / packagesmacOS softwareWindows software
10 mapped techniques
TeamPCP DUSTMAKER AI workspace poisoning
npmGitHub ActionsAI coding agentsMCPGit / GitHubVS Code / IDE
5 mapped techniques
Placeholder domain third-party.com turned live ClickFix server
CDN / web assetsAI coding agentsWindows softwareMCP
5 mapped techniques
GHAPPIER loader via @dforge-core/dforge-mcp trusted publishing
npmMCPGit / GitHubGitHub Actions
7 mapped techniques
Hades .pth and AI-assistant config persistence
npmPyPIAI coding agentsLinux distro / packagesmacOS softwareMCPWindows softwareDeveloper workstation
4 mapped techniques
@copilot-mcp/apex macOS infostealer republish
npmmacOS softwareMCPGit / GitHubKubernetesVS Code / IDE
4 mapped techniques