MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5788 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MCP Server Launched via uvx/npx by AI Assistant Without Commit Pin (Dependency Drift) — Exploitation Phase

Behaviour-first detection of the exposure Corelight describes: an AI assistant spawns uvx or npx to run an MCP server that resolves transitive dependencies from PyPI/npm at launch. Pinning the top-level package or a tag does not freeze the roughly 60 packages beneath it (23 of 69 packages drifted over 19 rebuilds), so a poisoned dependency (T1195.001) would execute Python/Node code (T1059.006/T1059.007) inside the MCP server process with access to API tokens. Output classifies each launch as latest_tag, unpinned or version_pinned_only and excludes commit-pinned installs. Inventory and hunting rule: no exploitation, CVE or actor is reported.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1059.006, T1059.007
• Data sources: sysmon (XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1), microsoft_defender_xdr (DeviceProcessEvents), sigma process_creation
• Severity: medium
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (CommandLine="*uvx*" OR CommandLine="*npx*" OR CommandLine="*uv tool run*")
```MCP dependency drift: AI assistant -> uvx/npx launcher lineage (Corelight, TL-2026-5788)```
| eval cmd=lower(CommandLine)
| where match(ParentImage,"(?i)(^|[^a-z])(claude|cursor|windsurf|code|zed)([.]exe)?$")
| where match(cmd,"(^|[^a-z])(uvx|npx)(-cli[.]js|[.]exe|[.]cmd)?( |$)") OR match(cmd,"uv tool run")
| eval pin_state=case(match(cmd,"@latest"),"latest_tag",match(cmd,"(@|==)[0-9a-f]{40}"),"commit_pinned",match(cmd,"(@|==)[0-9]+[.][0-9]+"),"version_pinned_only",true(),"unpinned")
| where pin_state!="commit_pinned"
| stats count as launches earliest(_time) as first_seen latest(_time) as last_seen values(CommandLine) as launcher_cmdline by Computer, User, ParentImage, pin_state
| convert ctime(first_seen) ctime(last_seen)
| sort - launches

Microsoft KQL

// MCP dependency drift: AI assistant -> uvx/npx launcher lineage (T1195.001)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName matches regex @"(?i)^(claude|cursor|windsurf|code|zed)([.]exe)?$"
| where ProcessCommandLine matches regex @"(?i)(^|[^a-z])(uvx|npx)(-cli[.]js|[.]exe|[.]cmd)?( |$)" or ProcessCommandLine has "uv tool run"
| extend PinState = case(
    ProcessCommandLine has "@latest", "latest_tag",
    ProcessCommandLine matches regex @"(@|==)[0-9a-f]{40}", "commit_pinned",
    ProcessCommandLine matches regex @"(@|==)[0-9]+[.][0-9]+", "version_pinned_only",
    "unpinned")
| where PinState != "commit_pinned"
| summarize Launches = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), LauncherCmd = make_set(ProcessCommandLine, 10) by DeviceName, AccountName, InitiatingProcessFileName, PinState
| order by Launches desc

Sigma

title: AI Assistant Launching uvx/npx MCP Server Without Commit Pinning
id: 7b3e1a52-5788-4c1d-9a0e-1f2b3c4d5e01
status: experimental
description: Detects an AI assistant (Claude, Cursor, Windsurf, VS Code, Zed) starting an MCP server through the one-step uvx or npx launchers without a Git commit pin. Transitive dependencies then resolve fresh from PyPI or npm on every rebuild (dependency drift), so a poisoned dependency would run inside the MCP server process with access to API tokens and files.
references:
  - https://corelight.com/blog/mcp-server-supply-chain-risk
  - https://cybersecuritynews.com/hackers-could-exploit-mcp-server/
  - https://nvd.nist.gov/vuln/detail/CVE-2025-6514
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.execution
  - attack.t1059.006
  - attack.t1059.007
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\claude.exe'
      - '\cursor.exe'
      - '\windsurf.exe'
      - '\code.exe'
      - '\zed.exe'
      - '/claude'
      - '/cursor'
      - '/windsurf'
      - '/code'
      - '/zed'
  selection_launcher_img:
    Image|endswith:
      - '\uvx.exe'
      - '/uvx'
  selection_launcher_cmd:
    CommandLine|contains:
      - 'npx '
      - 'npx.cmd'
      - 'npx-cli.js'
      - 'uv tool run'
  filter_commit_pinned:
    CommandLine|re: '(@|==)[0-9a-f]{40}'
  condition: selection_parent and 1 of selection_launcher_* and not filter_commit_pinned
falsepositives:
  - Developers intentionally running uvx or npx based MCP servers from their IDE
  - Approved MCP servers that are version pinned but still launched via uvx or npx
level: medium

Known false positives:

• Developers deliberately launching MCP servers from an IDE or AI assistant on approved workstations
• Security teams running vetted uvx/npx MCP servers that are version pinned but not commit pinned

Tuning notes: Adjust the AI-assistant parent regex to the clients deployed in your estate (add Claude Code or Goose wrappers). On Windows npx often appears as cmd.exe or node.exe running npx-cli.js, which the command-line match covers. Add an allowlist of approved Computer/User pairs and a lookup of reviewed MCP server names. Raise severity when the host holds management-system credentials. Adapt index and sourcetype for Sysmon for Linux or macOS EDR.

• 🔒 Runtime Package-Registry/GitHub DNS Lookups from Non-Developer Hosts — Exploitation Phase · unlock with TL Creds
• 🔒 Token-Extraction Commands Spawned by an MCP Server Process — Post-Exploitation · unlock with TL Creds
• 🔒 MCP Server Process Reaching New Internal Management Destinations — Lateral Movement / Valid Account Use · unlock with TL Creds
• 🔒 MCP Proxy Unpinned @latest, Vulnerable [indicator] (CVE-2025-6514) or TLS Verification Disabled — Exploitation Phase · unlock with TL Creds
• 🔒 AI Coding CLI Executed With Permission-Bypass Flags from a Runtime Parent — Post-Exploitation · unlock with TL Creds
• 🔒 Package Script Spawning Secret Scanner or npm Publish (Shai-Hulud-Style Propagation) — C2 / Propagation · unlock with TL Creds
• 🔒 MCP Server Process Spawning Commands That Read Credential and AI-Client Config Files — Post-Exploitation · unlock with TL Creds
• 🔒 uvx/npx Launcher TLS Burst Pattern to Registry and GitHub SNIs — C2 / Network Behaviour · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5788.

Sample indicators (3 of 12)

• Domain: github[.]com
• Domain: raw[.]githubusercontent[.]com
• Domain: objects[.]githubusercontent[.]com

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

Technical analysis

Corelight states this is a setup-choice weakness, not a flaw in MCP itself; no exploitation, CVE or threat actor is reported.

Corelight (James Lagermann, published 2026-11-10; reported by Cyber Security News on 2026-11-11) found AI assistants running MCP servers with privileged access while reviewing an administrator's workstation. No malware was found. The servers were started through uvx, a one-step launcher that downloads a Python package and runs it from a single line of client configuration. Even when the configuration pinned an exact release, version or Git commit, the roughly 60 transitive dependencies resolved from PyPI within allowed version ranges. One community server pinned seven direct dependencies and shipped a hash-locked file, but the launcher ignored the lock file and fetched about 60 other packages fresh on each rebuild.

Over five weeks one server release/commit was rebuilt 19 times, producing 15 distinct dependency sets; 23 of 69 packages changed versions, including cryptography, a JWT library (four versions) and the MCP SDK. Corelight observed the same drift on every server launched this way, with no configuration change. One assistant started a server 162 times in a week; most launches only checked the Git tag and reused cache. Of 35 MCP servers reviewed (two vendor catalogs plus the authors' lab), 23 had a recommended install that resolves dependencies from a public registry at install time. Some vendor setups run a local proxy via npx with the @latest tag, fetching the newest version at every start; one proxy released six versions in a month, four within 14 hours, and one vendor example disabled TLS verification for the whole proxy process. The article links this class of setup to the mcp-remote flaw CVE-2025-6514 (CVSS 9.6, affects 0.0.5-0.1.15, fixed in 0.1.16).

All dependencies execute inside the MCP server process, so any one of them can read API tokens, user files and reachable network paths; malicious packages can execute at Python startup without being called. In the lab the servers made more than 1,600 connections in one week to 11 management systems (firewall, SIEM, sensor management). Attacker entry points to a dependency are reused maintainer passwords, phished tokens or weak release pipelines, as in xz Utils, Ultralytics, Nx s1ngularity and the Shai-Hulud npm worm (a June 2026 variant reached PyPI, including MCP-themed packages, and targeted cloud credentials, GitHub tokens and AI coding tool API keys; in one wave six malicious releases were live for under 30 minutes). Frequently rebuilt, auto-started servers have more exposure during such windows.

Detection per Corelight: hunt DNS lookups and TLS SNI for GitHub download domains, pypi.org, files.pythonhosted.org and registry.npmjs.org from hosts that should not install code at runtime; launcher sessions appear as two to five short sessions (0.1-1.5 s, about 24 KB per tag check) within about three seconds of each launch; JA3 is unreliable because the client randomizes its handshake (about 100 hashes per burst), so JA4 is recommended; EDR process lineage AI assistant -> launcher -> MCP server attributes the traffic. In the lab one admin workstation had 203 GitHub and 136 PyPI connections while development/jump/container hosts had zero PyPI. The listed domains are legitimate hunting telemetry, not malicious indicators. Remediation: pin to a commit, install from a hash-pinned lock file into a dedicated environment with hash checking, launch the installed server directly, disable startup update checks, scope each server to least-privilege credentials and assign an update owner. Validation: five frozen servers started 457 times over two weeks with unchanged package lists.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059.006 Python; T1059.007 JavaScript

Defense Evasion

T1078 Valid Accounts

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files

Remediation

Patches

• Upgrade mcp-remote to 0.1.16 or later (CVE-2025-6514)

Immediate actions

• Find non-developer hosts that pull code at runtime (DNS/TLS/EDR hunt for github.com, codeload.github.com, raw.githubusercontent.com, objects.githubusercontent.com, pypi.org, files.pythonhosted.org, registry.npmjs.org)
• Audit AI client configurations for one-step runners (uvx/npx) and @latest tags
• Inventory the credentials and management systems each MCP server can reach
• Freeze credential-holding MCP servers

Workarounds

• Pin MCP servers to a Git commit rather than a tag
• Install from a hash-pinned lock file into a dedicated environment with hash checking, then install the server without dependency resolution
• Launch the installed server directly rather than via uvx/npx
• Disable startup update checks
• Do not disable TLS verification for proxies; use a trusted CA

Longer-term hardening

• Assign a named owner to review and re-lock MCP server dependencies on a schedule, including CVE review
• Give each MCP server its own least-privilege, read-only where possible, expiring credentials
• Adopt JA4 TLS fingerprinting; plan for reduced SNI visibility as Encrypted ClientHello spreads
• Verify fixes by comparing installed package versions across restarts

Affected and fixed versions

• Various (MCP ecosystem) — MCP servers launched via uvx (PyPI) or npx (npm) without pinned transitive dependencies
  Vulnerable versions: Configurations that resolve dependencies at launch (23 of 35 reviewed servers)
  Fixed in: Commit-pinned, hash-locked, directly launched installs

Timeline

• 2024-03-29 xz Utils backdoor (CVE-2024-3094) in two releases, cited by Corelight as precedent for package hijack.
• 2024-12-04 Compromised Ultralytics PyPI releases installed a cryptominer and were available about 12 hours (December 2024).
• 2025-07-09 CVE-2025-6514 (mcp-remote OS command injection, CVSS 9.6, 0.0.5-0.1.15) published; fixed in 0.1.16.
• 2025-08-26 Nx s1ngularity: malicious npm versions stole tokens and keys and ran local AI coding assistant CLIs to search for secrets (August 2025).
• 2025-09-15 Shai-Hulud self-spreading npm worm begins using stolen npm tokens to publish infected versions (September 2025); a June 2026 variant later reached PyPI including MCP-themed packages.
• 2026-11-10 Corelight publishes research on MCP server dependency drift: 19 rebuilds, 15 dependency sets, 23 of 69 packages changed in five weeks; 23 of 35 reviewed servers install from a public registry.
• 2026-11-11 Cyber Security News reports the Corelight findings; no exploitation, CVE or threat actor reported.

Sources cited

• NVD: CVE-2025-6514 (mcp-remote OS command injection) NVD (NIST) · Advisory · 2025-07-09
• The supply-chain risk hiding in your MCP servers (Corelight) corelight.com · Research · 2026-11-10
• JFrog: CVE-2025-6514 Critical mcp-remote RCE Vulnerability jfrog.com · Research · 2025-07-09
• mcp-remote fix commit GitHub · Code repository · 2025-07-09
• Hackers Could Exploit MCP Server Supply Chain Weaknesses to Steal API Keys and Administrator Credentials cybersecuritynews.com · News · 2026-11-11
• Critical mcp-remote Vulnerability Exposes LLM Clients cybersecuritynews.com · News · 2025-07-10

More in supply chain

• Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)
• Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies
• Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)
• Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations
• AI Is Both Target and Tool for Threat Actors: AI-Involved Supply-Chain, Malware and Extortion Trends (Insikt Group, Jul 2025 - Jul 2026)

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages