# MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials

> Corelight research shows MCP servers launched with uvx or npx resolve transitive dependencies fresh from PyPI/npm, so pinning the top-level package does not freeze the packages beneath it. A poisoned dependency would run inside the MCP server process with access to API tokens, user files and reachable management systems. Corelight states this is a setup-choice weakness, not a flaw in MCP itself; no exploitation, CVE or threat actor is reported.

- **Published:** 2026-11-11T19:03:46Z
- **Last reviewed:** 2026-11-11T19:03:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5788
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5788.png
- **ID:** TL-2026-5788
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (3 shown free below)
- **CVEs:** CVE-2025-6514

## Description

Corelight (James Lagermann, published 2026-11-10; reported by Cyber Security News on 2026-11-11) found AI assistants running MCP servers with privileged access while reviewing an administrator's workstation. No malware was found. The servers were started through uvx, a one-step launcher that downloads a Python package and runs it from a single line of client configuration. Even when the configuration pinned an exact release, version or Git commit, the roughly 60 transitive dependencies resolved from PyPI within allowed version ranges. One community server pinned seven direct dependencies and shipped a hash-locked file, but the launcher ignored the lock file and fetched about 60 other packages fresh on each rebuild.

Over five weeks one server release/commit was rebuilt 19 times, producing 15 distinct dependency sets; 23 of 69 packages changed versions, including cryptography, a JWT library (four versions) and the MCP SDK. Corelight observed the same drift on every server launched this way, with no configuration change. One assistant started a server 162 times in a week; most launches only checked the Git tag and reused cache. Of 35 MCP servers reviewed (two vendor catalogs plus the authors' lab), 23 had a recommended install that resolves dependencies from a public registry at install time. Some vendor setups run a local proxy via npx with the @latest tag, fetching the newest version at every start; one proxy released six versions in a month, four within 14 hours, and one vendor example disabled TLS verification for the whole proxy process. The article links this class of setup to the mcp-remote flaw CVE-2025-6514 (CVSS 9.6, affects 0.0.5-0.1.15, fixed in 0.1.16).

All dependencies execute inside the MCP server process, so any one of them can read API tokens, user files and reachable network paths; malicious packages can execute at Python startup without being called. In the lab the servers made more than 1,600 connections in one week to 11 management systems (firewall, SIEM, sensor management). Attacker entry points to a dependency are reused maintainer passwords, phished tokens or weak release pipelines, as in xz Utils, Ultralytics, Nx s1ngularity and the Shai-Hulud npm worm (a June 2026 variant reached PyPI, including MCP-themed packages, and targeted cloud credentials, GitHub tokens and AI coding tool API keys; in one wave six malicious releases were live for under 30 minutes). Frequently rebuilt, auto-started servers have more exposure during such windows.

Detection per Corelight: hunt DNS lookups and TLS SNI for GitHub download domains, pypi.org, files.pythonhosted.org and registry.npmjs.org from hosts that should not install code at runtime; launcher sessions appear as two to five short sessions (0.1-1.5 s, about 24 KB per tag check) within about three seconds of each launch; JA3 is unreliable because the client randomizes its handshake (about 100 hashes per burst), so JA4 is recommended; EDR process lineage AI assistant -> launcher -> MCP server attributes the traffic. In the lab one admin workstation had 203 GitHub and 136 PyPI connections while development/jump/container hosts had zero PyPI. The listed domains are legitimate hunting telemetry, not malicious indicators. Remediation: pin to a commit, install from a hash-pinned lock file into a dedicated environment with hash checking, launch the installed server directly, disable startup update checks, scope each server to least-privilege credentials and assign an update owner. Validation: five frozen servers started 457 times over two weeks with unchanged package lists.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.006 Python
- T1059.007 JavaScript
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MCP Server Launched via uvx/npx by AI Assistant Without Commit Pin (Dependency Drift) — Exploitation Phase** (`TL-2026-5788-SPL-001`)

Behaviour-first detection of the exposure Corelight describes: an AI assistant spawns uvx or npx to run an MCP server that resolves transitive dependencies from PyPI/npm at launch. Pinning the top-level package or a tag does not freeze the roughly 60 packages beneath it (23 of 69 packages drifted over 19 rebuilds), so a poisoned dependency (T1195.001) would execute Python/Node code (T1059.006/T1059.007) inside the MCP server process with access to API tokens. Output classifies each launch as latest_tag, unpinned or version_pinned_only and excludes commit-pinned installs. Inventory and hunting rule: no exploitation, CVE or actor is reported.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1059.006, T1059.007
- **Data sources:** sysmon (XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1), microsoft_defender_xdr (DeviceProcessEvents), sigma process_creation
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

````spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (CommandLine="*uvx*" OR CommandLine="*npx*" OR CommandLine="*uv tool run*")
```MCP dependency drift: AI assistant -> uvx/npx launcher lineage (Corelight, TL-2026-5788)```
| eval cmd=lower(CommandLine)
| where match(ParentImage,"(?i)(^|[^a-z])(claude|cursor|windsurf|code|zed)([.]exe)?$")
| where match(cmd,"(^|[^a-z])(uvx|npx)(-cli[.]js|[.]exe|[.]cmd)?( |$)") OR match(cmd,"uv tool run")
| eval pin_state=case(match(cmd,"@latest"),"latest_tag",match(cmd,"(@|==)[0-9a-f]{40}"),"commit_pinned",match(cmd,"(@|==)[0-9]+[.][0-9]+"),"version_pinned_only",true(),"unpinned")
| where pin_state!="commit_pinned"
| stats count as launches earliest(_time) as first_seen latest(_time) as last_seen values(CommandLine) as launcher_cmdline by Computer, User, ParentImage, pin_state
| convert ctime(first_seen) ctime(last_seen)
| sort - launches
````

### Microsoft KQL

```kql
// MCP dependency drift: AI assistant -> uvx/npx launcher lineage (T1195.001)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName matches regex @"(?i)^(claude|cursor|windsurf|code|zed)([.]exe)?$"
| where ProcessCommandLine matches regex @"(?i)(^|[^a-z])(uvx|npx)(-cli[.]js|[.]exe|[.]cmd)?( |$)" or ProcessCommandLine has "uv tool run"
| extend PinState = case(
    ProcessCommandLine has "@latest", "latest_tag",
    ProcessCommandLine matches regex @"(@|==)[0-9a-f]{40}", "commit_pinned",
    ProcessCommandLine matches regex @"(@|==)[0-9]+[.][0-9]+", "version_pinned_only",
    "unpinned")
| where PinState != "commit_pinned"
| summarize Launches = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), LauncherCmd = make_set(ProcessCommandLine, 10) by DeviceName, AccountName, InitiatingProcessFileName, PinState
| order by Launches desc
```

### Sigma

```yaml
title: AI Assistant Launching uvx/npx MCP Server Without Commit Pinning
id: 7b3e1a52-5788-4c1d-9a0e-1f2b3c4d5e01
status: experimental
description: Detects an AI assistant (Claude, Cursor, Windsurf, VS Code, Zed) starting an MCP server through the one-step uvx or npx launchers without a Git commit pin. Transitive dependencies then resolve fresh from PyPI or npm on every rebuild (dependency drift), so a poisoned dependency would run inside the MCP server process with access to API tokens and files.
references:
  - https://corelight.com/blog/mcp-server-supply-chain-risk
  - https://cybersecuritynews.com/hackers-could-exploit-mcp-server/
  - https://nvd.nist.gov/vuln/detail/CVE-2025-6514
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.execution
  - attack.t1059.006
  - attack.t1059.007
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\claude.exe'
      - '\cursor.exe'
      - '\windsurf.exe'
      - '\code.exe'
      - '\zed.exe'
      - '/claude'
      - '/cursor'
      - '/windsurf'
      - '/code'
      - '/zed'
  selection_launcher_img:
    Image|endswith:
      - '\uvx.exe'
      - '/uvx'
  selection_launcher_cmd:
    CommandLine|contains:
      - 'npx '
      - 'npx.cmd'
      - 'npx-cli.js'
      - 'uv tool run'
  filter_commit_pinned:
    CommandLine|re: '(@|==)[0-9a-f]{40}'
  condition: selection_parent and 1 of selection_launcher_* and not filter_commit_pinned
falsepositives:
  - Developers intentionally running uvx or npx based MCP servers from their IDE
  - Approved MCP servers that are version pinned but still launched via uvx or npx
level: medium

```

**Known false positives:**

- Developers deliberately launching MCP servers from an IDE or AI assistant on approved workstations
- Security teams running vetted uvx/npx MCP servers that are version pinned but not commit pinned

**Tuning notes:** Adjust the AI-assistant parent regex to the clients deployed in your estate (add Claude Code or Goose wrappers). On Windows npx often appears as cmd.exe or node.exe running npx-cli.js, which the command-line match covers. Add an allowlist of approved Computer/User pairs and a lookup of reviewed MCP server names. Raise severity when the host holds management-system credentials. Adapt index and sourcetype for Sysmon for Linux or macOS EDR.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Runtime Package-Registry/GitHub DNS Lookups from Non-Developer Hosts — Exploitation Phase (locked: unlock with TL Creds)
- Token-Extraction Commands Spawned by an MCP Server Process — Post-Exploitation (locked: unlock with TL Creds)
- MCP Server Process Reaching New Internal Management Destinations — Lateral Movement / Valid Account Use (locked: unlock with TL Creds)
- MCP Proxy Unpinned @latest, Vulnerable [indicator] (CVE-2025-6514) or TLS Verification Disabled — Exploitation Phase (locked: unlock with TL Creds)
- AI Coding CLI Executed With Permission-Bypass Flags from a Runtime Parent — Post-Exploitation (locked: unlock with TL Creds)
- Package Script Spawning Secret Scanner or npm Publish (Shai-Hulud-Style Propagation) — C2 / Propagation (locked: unlock with TL Creds)
- MCP Server Process Spawning Commands That Read Credential and AI-Client Config Files — Post-Exploitation (locked: unlock with TL Creds)
- uvx/npx Launcher TLS Burst Pattern to Registry and GitHub SNIs — C2 / Network Behaviour (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 12)

Defanged, TLP:CLEAR.

- Domain: `github[.]com`
- Domain: `raw[.]githubusercontent[.]com`
- Domain: `objects[.]githubusercontent[.]com`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Could Exploit MCP Server Supply Chain Weaknesses to Steal API Keys and Administrator Credentials](https://cybersecuritynews.com/hackers-could-exploit-mcp-server/)
- [The supply-chain risk hiding in your MCP servers (Corelight)](https://corelight.com/blog/mcp-server-supply-chain-risk)
- [Critical mcp-remote Vulnerability Exposes LLM Clients](https://cybersecuritynews.com/critical-mcp-remote-vulnerability-exposes-llm-clients/)
- [NVD: CVE-2025-6514 (mcp-remote OS command injection)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-6514)
- [JFrog: CVE-2025-6514 Critical mcp-remote RCE Vulnerability](https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability)
- [mcp-remote fix commit](https://github.com/geelen/mcp-remote/commit/607b226a356cb61a239ffaba2fb3db1c9dea4bac)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5788