MCP typosquatting: lessons from npm

Package registries follow a predictable security arc. A young ecosystem optimizes for growth: publishing is frictionless, names are first-come-first-served, and trust is assumed. Then the attacks arrive — and they arrive in a known order, because attackers reuse what works. npm ran this curriculum in public for a decade. MCP registries are enrolling now.

What npm taught everyone

• 2016, left-pad: an unpublishing incident, rather than a malicious release, disrupted builds that depended on the package. npm’s incident account explains the dependency and registry consequences.
• 2017, the crossenv wave: dozens of typosquats of popular packages (crossenv for cross-env, and friends) harvesting environment variables at install time. The template attack: a name one keystroke away and code executing during installation. npm’s report documents the environment-variable theft.
• 2018, event-stream: a maintainer handoff to a helpful stranger, who shipped a targeted payload through a transitive dependency. The lesson: the package you trust is only as stable as its least-supported maintainer. npm’s investigation describes the malicious transitive package.
• 2021, ua-parser-js: a hijacked maintainer account pushing malicious versions of a widely used package. The project incident discussion records the affected releases. Compromise the publisher, skip the typosquat.
• 2025, the chalk/debug phishing wave: maintainer credentials phished, malicious versions of foundational packages published after an account takeover. The debug advisory documents the September 8 incident and affected version.

Ten years, one pattern: attackers go where installation is habitual and review is rare.

Why MCP registries are next — and worse

MCP server installation is as habitual as npm install ever was: copy a config snippet from a README, paste it into .mcp.json, restart the client. The registries are young, names are first-come-first-served, and provenance is unevenly adopted. All the 2017 conditions, fresh.

But three things make the MCP version of this attack more dangerous than its npm ancestor:

1. Servers run with agent privileges. A typosquatted linter runs in a build. A typosquatted MCP server gets whatever the agent has: filesystem roots, environment secrets, API scopes, and every session’s context.
2. The payload can be text, not code. An npm typosquat needs malicious code that a scanner might flag. An MCP typosquat can ship perfectly clean code plus a poisoned tool description — instructions the agent reads and no code audit sees.
3. Unpinned-by-default is the norm. MCP config snippets overwhelmingly reference latest. Every session launch is a fresh resolution — which means a package that was clean when reviewed can go hostile without anyone touching the config. The rug pull is built in.

The defenses npm’s decade validated

None of this requires new inventions — it requires applying the countermeasures npm’s history already validated, at the config layer where MCP lives:

• Name-distance checks against known-official servers, weighted by publisher signals: account age, download history, linked repository, install-script behavior.
• Provenance attestation on the resolved version, tying the artifact to a source commit and build — the difference between “named like the vendor” and “built by the vendor”.
• Version pinning everywhere, so a compromise upstream becomes a reviewable diff instead of a silent upgrade.
• An org allowlist for remote endpoints, because a URL in a config file is a dependency too — one that can change behavior without changing its name.
• Continuous re-scanning, because every lesson above ends the same way: the state of a package at review time guarantees nothing about next week.

The uncomfortable part is scale. One engineer can apply this list to one server (here’s the checklist); no one applies it by hand to every server in every repo, forever. That’s the gap RingZero’s MCP security addresses with config discovery, local spelling/pinning/secret checks, and an approved catalog. Registry enrichment and generated fix PRs are planned, with dependency scanning covering the classic package supply chain beside it.

npm’s decade of incidents was expensive tuition. MCP gets the syllabus for free — the only question is which teams do the reading before their first incident, and which after.