Typosquatting comes for MCP registries: lessons from npm's decade of supply chain attacks

Package registries follow a predictable security arc. A young ecosystem optimizes for growth: publishing is frictionless, names are first-come-first-served, and trust is assumed. Then the attacks arrive — and they arrive in a known order, because attackers reuse what works. npm ran this curriculum in public for a decade. MCP registries are enrolling now.

What npm taught everyone

• 2016, left-pad: not an attack, but the moment everyone understood how deep and fragile the dependency graph really was — eleven lines unpublished, half the ecosystem’s builds broken.
• 2017, the crossenv wave: dozens of typosquats of popular packages (crossenv for cross-env, and friends) harvesting environment variables at install time. The template attack: a name one keystroke away, a postinstall script, and patience.
• 2018, event-stream: a maintainer handoff to a helpful stranger, who shipped a targeted payload through a transitive dependency. The lesson: the package you trust is only as stable as its least-supported maintainer.
• 2021, ua-parser-js: a hijacked maintainer account pushing malicious versions of a package with millions of weekly downloads. Compromise the publisher, skip the typosquat.
• 2025, the chalk/debug phishing wave: maintainer credentials phished, malicious versions of foundational packages live for hours — proving that even a mature registry with provenance tooling still moves at the speed of one stolen login.

Ten years, one pattern: attackers go where installation is habitual and review is rare.

Why MCP registries are next — and worse

MCP server installation is as habitual as npm install ever was: copy a config snippet from a README, paste it into .mcp.json, restart the client. The registries are young, names are first-come-first-served, and provenance is unevenly adopted. All the 2017 conditions, fresh.

But three things make the MCP version of this attack more dangerous than its npm ancestor:

1. Servers run with agent privileges. A typosquatted linter runs in a build. A typosquatted MCP server gets whatever the agent has: filesystem roots, environment secrets, API scopes, and every session’s context.
2. The payload can be text, not code. An npm typosquat needs malicious code that a scanner might flag. An MCP typosquat can ship perfectly clean code plus a poisoned tool description — instructions the agent reads and no code audit sees.
3. Unpinned-by-default is the norm. MCP config snippets overwhelmingly reference latest. Every session launch is a fresh resolution — which means a package that was clean when reviewed can go hostile without anyone touching the config. The rug pull is built in.

The defenses npm’s decade validated

None of this requires new inventions — it requires applying the countermeasures npm’s history already validated, at the config layer where MCP lives:

• Name-distance checks against known-official servers, weighted by publisher signals: account age, download history, linked repository, install-script behavior.
• Provenance attestation on the resolved version, tying the artifact to a source commit and build — the difference between “named like the vendor” and “built by the vendor”.
• Version pinning everywhere, so a compromise upstream becomes a reviewable diff instead of a silent upgrade.
• An org allowlist for remote endpoints, because a URL in a config file is a dependency too — one that can change behavior without changing its name.
• Continuous re-scanning, because every lesson above ends the same way: the state of a package at review time guarantees nothing about next week.

The uncomfortable part is scale. One engineer can apply this list to one server (here’s the checklist); no one applies it by hand to every server in every repo, forever. That’s the gap RingZero’s MCP security closes — an org-wide inventory, registry cross-checks on every server, and a proposed config fix for every finding — with dependency scanning covering the classic package supply chain beside it.

npm’s decade of incidents was expensive tuition. MCP gets the syllabus for free — the only question is which teams do the reading before their first incident, and which after.