Threat video1:00
MCP uvx/npx Drift Exposes API Keys: Detection & IOCs
Unpinned uvx and npx launches can pull a poisoned dependency into MCP servers. Get 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for MCP uvx/npx Drift Exposes API Keys: Detection & IOCs →
Chapters
- 0:00The hookPinning the server did not freeze its dependencies.
- 0:04The storyCorelight saw 23 of 69 packages changed.
- 0:12Attack pathPer reported research, a poisoned dependency would run inside.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise9 indicators to hunt: 7 domains and 2 package names.
- 0:38MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to collection.
- 0:43Remediation4 steps now: Find non-developer hosts that pull code at runtime.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Pinning the server did not freeze its dependencies.
0:05Corelight saw 23 of 69 packages changed.
0:09Servers drifted with no config change.
0:13Per reported research, a poisoned dependency would run inside.
0:17Launchers resolve dependencies fresh from public registries.
0:21It would reach API tokens and user files.
0:24No malware was found.
0:28No threat actor is attributed. Confidence: low.
0:339 indicators to hunt: 7 domains and 2 package names.
0:387 ATT&CK techniques, from initial access to collection.
0:434 steps now: Find non-developer hosts that pull code at runtime.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.