Fifteen clean versions, then the payload
A supply-chain attack that earns its place before it acts is not new. What is new is the category it landed in, and how little defends it.
Researchers identified a package that published fifteen clean releases before adding exfiltration code, with an associated CVE rated 9.6.
Fifteen is the number that matters
This was not a typosquat hoping for a mistaken install. It was a package that earned its place in real projects, accumulated dependents, and then changed. Every automated check that examines a package at install time would have passed it fourteen times, correctly, because there was nothing to find.
That is the defining property of a patient supply-chain attack and it defeats the entire class of install-time scanning that most organisations rely on. The defence has to be continuous rather than at acquisition, and almost nobody is doing continuous.
Why this category is especially attractive
A model context protocol server exists to give a model access to something: files, an API, a database. It sits precisely where credentials, data and execution meet. Compromising one is not compromising an endpoint, it is compromising the connection — with the access already granted and the traffic already expected.
The ecosystem defences are immature in a specific and predictable way. Most of these servers are small, single-author packages, installed with little review, in a category that did not exist two years ago. That exact combination has produced supply-chain incidents in every previous ecosystem it has appeared in.
It is the same lesson as the frameworks
Nearly a dozen flaws in major agent frameworks and a malicious connector in the wild are the same finding from two directions: the model gets the scrutiny while the things that give it hands get almost none.
And it is why compiling governance rules into prompts cannot be the whole answer. A guardrail written into the context window sits in the same token stream as everything else, competing with content that arrives later. Useful against accidents. Not a control against an adversary who already owns the connector.
What to actually do
Pin versions. Review diffs on update rather than on install. Scope credentials to the narrowest thing the server needs. Assume the connector will eventually be hostile and ask what it could reach on that day.
None of that is novel and all of it is well understood in older ecosystems. The gap is not knowledge. It is that this category grew faster than the practice around it, which is the most ordinary security story there is.
The Register — Prompt injection isn't the bug, AI agent frameworks are → · Help Net Security — Prompt injection still drives most agentic AI security failures in production → · arXiv — Policy-as-prompt: turning AI governance rules into guardrails for AI agents →