Campaign compromises 23 AI projects in 74 minutes via MCP server supply chain

·1 views

A campaign known as Deadbugz reportedly compromised 23 AI projects within 74 minutes by exploiting a dependency on a malicious MCP server rather than a flaw in the projects' own code. The attack appears to have been prepared in advance and run against a pre-selected target list. Researchers cite postmark-mcp as the first malicious MCP server identified in the wild, one that functioned as advertised while also performing hidden actions. Independent counts put the public MCP server population above 21,000, with many packages receiving little security review. In response, Cisco AI Defense released three open source scanners, MCP Scanner, A2A Scanner and Skill Scanner, to automate parts of dependency review.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why a Polished Store Page Sells Nothing Without Distribution

A creator who spent a weekend perfecting a store page logged 14 views and zero sales in a week, while identical assets on stock marketplaces produced sales. The author found that stock platforms accept bulk uploads via metadata CSVs, but each requires a different column count, and a wrong header is rejected at upload. Duplicate submissions risked flags, so the author built a plain-text ledger to track what had already been posted. The piece also notes that proper cover images and converting notes to styled PDFs helped turn raw files into sellable products. The author credits packaging and distribution, rather than art quality, for scaling the project to 39 products.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FreelanceCanvas Uses Local Gemma to Draft Client Proposals From Briefs

A developer built FreelanceCanvas, an open-source tool that helps freelancers turn a client brief or PDF into a complete proposal. The app looks up the client, searches the freelancer's past projects for relevant work, and sends the combined context to Gemma running locally through Ollama. Its output includes a client snapshot, a milestone schedule with a price estimate, a short risk list, and an optional audio script. The project is designed to degrade gracefully, falling back to basic profiles or templates when optional services or keys are unavailable. It was submitted to the Hacktoberfest Open-Source AI Challenge.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Enforcing link expiry at read time instead of relying on a background sweeper

A developer building a short-link service added an optional time-to-live after users requested temporary links for event invites, one-time documents, and agent handoffs. The first approach used a periodic sweeper to delete expired rows, but this made the database the source of liveness and introduced timing gaps. The redesign checks expiry at read time, with the sweeper serving only as a garbage collector for already-expired rows. The redirect handler returns the same 410 response whether a link never existed or has expired, so callers cannot distinguish the two cases. The author notes that links still expire correctly even when the sweeper is not run, and presents the approach as a general principle for ephemeral resources.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ConfiDict: A Private AI Vocabulary Coach That Grades Your Own Definitions

ConfiDict is a local-first vocabulary trainer built for the Hacktoberfest Open-Source AI Challenge, designed to help learners focus on the words they understand least. Instead of self-grading flashcards, users write definitions in their own words, and a locally run open-weight Gemma model rates each answer as strong, correct, partial, or incorrect with brief feedback. Each word carries a visible 0-100 confidence score, and a daily five-card session is drawn from the 15 lowest-scoring words using weighted randomness. Intended users include exam candidates preparing for IELTS, TOEFL, or GRE, adults improving workplace vocabulary, and tutors sharing curated word lists. The project is MIT-licensed, stores all data in the browser via IndexedDB without accounts or backend storage, and uses React, Vite, Ollama, and Vitest.

0 comments Read more at DEV Community