Developer builds 8-layer security system for MCP marketplace after trojan slipped through

·2 views

A developer running an MCP skills marketplace at marketnow.site discovered a trojan (Trojan:Win64/Lazy.PGPK!MTB) hidden inside a nested zip file, prompting a comprehensive security overhaul. The resulting defense-in-depth system comprises eight distinct layers, including metadata validation, static code analysis with secret detection, recursive zip inspection, and YARA-style malware signature matching covering families like Emotet, Cobalt Strike, and Mimikatz. A web application firewall layer screens every incoming HTTP request for SQL injection, XSS, path traversal, SSRF, and command injection patterns, automatically banning repeat offenders. Additional layers include honeypot trap paths that auto-ban vulnerability scanners attempting to access files like /.env. Each layer targets specific threat vectors, and the developer verified the package scanner against the original malicious zip to confirm it catches the exact trojan that initially evaded detection.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Clock Drift Broke a Redis Lock, Letting Two Workers Run the Same Billing Job

A nightly billing-reconciliation system designed to run once on one of three workers accidentally executed twice simultaneously, doubling entries for the same customer batch. The root cause was an NTP daemon that had silently stopped syncing after a container restart, leaving one worker's clock running roughly 9 seconds behind the Redis server's clock. Because Redis measures lock expiry using its own clock, the 30-second lock expired sooner than the worker expected, allowing a second worker to acquire it while the first was still running. The engineering team resolved the issue with three fixes: adding a background thread to auto-renew the lock, introducing monotonically increasing fencing tokens to reject stale writes, and adding explicit monitoring alerts on NTP synchronisation status. The incident highlights a fundamental risk in lease-based distributed locks — the lock server and client clocks must stay in close agreement, or the safety margin can silently disappear.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Treat Scope Creep as a State Machine, Not a Client Problem

A framework published on DEV Community argues that scope creep is best managed as a structured state machine rather than blamed on difficult clients or poor relationships. Under this model, every new project request must be classified into one of four states: included, swapped, deferred, or added — before any work begins. The approach requires developers to calculate and communicate both the fee impact and schedule impact of each change, accounting for factors beyond raw coding time such as context switching, retesting, and displaced capacity. A standard response template is proposed to acknowledge requests, name scope boundaries, and obtain written approval without conflict. The author also recommends defining clear acceptance criteria at project kickoff to make future scope disputes easier to resolve by reference rather than negotiation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Tool Lets Solo Founders Automate Email Verification in Signup Bots

A new guide published on DEV Community explains how solo founders and non-engineers can fully automate account registration workflows, including the email verification step that typically requires manual intervention. The solution combines Playwright, a browser automation engine, with Claude Code, an AI coding agent, so users can describe tasks in plain English without writing code themselves. A key component is the UnCorreoTemporal MCP server, which provides the bot with a fresh disposable inbox for each run, eliminating the need to use personal or reused email addresses. The server supplies dedicated tools such as create_signup_inbox and wait_for_verification_email, allowing Claude Code to handle the entire signup loop autonomously. The approach addresses common pain points like personal inbox bottlenecks, flagged reused addresses, and the complexity of connecting real email accounts programmatically.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub Launches Agentic Autofix for Code Scanning Alerts in Public Preview

GitHub released an agentic autofix feature for code scanning alerts in public preview on July 10, 2026, designed to automatically generate patches for identified vulnerabilities. The system moves each alert through multiple stages — from candidate patch generation through build, testing, security checks, and human review before any merge. Experts caution that simply measuring the percentage of alerts with a generated patch is a misleading success metric, as generation is only the first of many critical steps. A structured evaluation framework is recommended, using deterministic canary assignments, detailed failure classification, and predeclared reliability gates to ensure patches genuinely resolve security issues without introducing regressions. Broader deployment should be justified by bounded evidence and explicit safety checks rather than surface-level averages.

0 comments Read more at DEV Community