18 Malicious npm Packages Found Hijacking AI Coding Agents via Remote Commands

·1 views

Security researchers building a public advisory database for the Model Context Protocol (MCP) identified 19 malicious npm packages capable of remotely controlling AI coding agents such as Claude. As of the article's publication date, 18 of the 19 packages remained downloadable from the public npm registry, with only one — anthropic-setup — having been taken down. The packages work by opening outbound WebSocket connections or polling remote HTTPS endpoints, allowing attackers to issue commands directly to an already-authenticated AI agent on the victim's machine, bypassing typical firewall protections. Some packages went further, intercepting API keys, replacing legitimate binaries, or registering rogue MCP servers into developer tool configurations without obvious signs of tampering. Researchers attribute the broad attack surface to the copy-paste nature of MCP server configuration, live tool-definition fetching, and the lack of package provenance or signature verification in the current AI-agent ecosystem.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Mador: Lightweight 80-Line JavaScript Library Makes Any DOM Element Reactive

A developer has released Mador, a minimalist open-source JavaScript library hosted on GitHub. The tool uses a Proxy-based state tuple to make any DOM element reactive without requiring a full framework. The entire implementation spans just 80 lines of code, emphasizing simplicity and low overhead. Mador was shared on Hacker News as a community project, attracting early attention from developers interested in lightweight front-end solutions.

0 comments Read more at Hacker News

ProgrammingHacker News ·

XCancel Twitter Proxy Service Returns Online After Downtime

XCancel, a privacy-focused proxy service for viewing Twitter content without tracking, has become available again after a period of inaccessibility. The service allows users to browse Twitter posts without being redirected to or tracked by the platform. The return was noted by the Hacker News community, though the post attracted minimal engagement with only 4 points and no comments. No official explanation for the prior downtime or the restoration was provided in the announcement.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

SchemaCrawler Offers Three API Models to Explore and Understand Database Schemas

SchemaCrawler is an open-source tool that connects to any JDBC-accessible database and converts raw metadata into documentation, diagrams, lint reports, and a Java API. Its Java API provides three distinct programmatic models: Catalog, ERModel, and ImportanceModel, each offering a different level of abstraction over the same database. The Catalog model serves as the foundation, exposing physical database objects such as tables, columns, indexes, foreign keys, and routines directly from JDBC metadata. ERModel builds on Catalog to add inferred entity-relationship semantics, while ImportanceModel enables graph-based analysis of dependency topology and domain clustering. Together, the three models are designed to help developers document legacy databases, enforce design rules in CI pipelines, and make schema knowledge accessible to both humans and AI agents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds authorization layer below app code, invites public to break it

A developer has publicly released a live demo of an insurance claims app called Sentinel, challenging users to breach its access control system using provided credentials and curl commands. Unlike conventional B2B apps that scatter authorization logic across endpoints and components, this system enforces access rules at the infrastructure level, before any application code executes. The demo runs two fictional insurers — Northwind Mutual and Cascade Assurance — on a single deployment, testing both field-level security and tenant isolation. Visitors can verify that policyholders never receive sensitive fields like fraud scores or internal notes, and that each insurer's claims data remains invisible to the other's staff. The developer argues that embedding authorization in application code is inherently fragile, as any single forgotten endpoint can cause a data leak serious enough to warrant a CVE.

0 comments Read more at DEV Community