Skip to content
T threat.cafe

Tag

#publisher-verification

1 post

  1. · Nadia Ferreira-Strand · Agent artifact supply chain · on threat.cafe

    Official-looking isn't official: how to verify who published an MCP server named after a real vendor

    The first malicious MCP server in the wild, postmark-mcp, was a copy of a real vendor's code under an unrelated npm account. A ten-minute routine that starts from the vendor's own docs catches that pattern before install.