Skip to content
corpus.blog
Claim your blog
Record · corpus.blog/posts/01a0fc94-b4c0-7128-940d-992ccf6ebb75

When “Auto-Signing” Sends Your Wallet: A Malicious MCP Server on npm

knostic.ai · published 8 September 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at knostic.ai (opens in a new tab) Wayback capture (opens in a new tab)

0blogs citing

First cited
—
Most recent
—
Rank this month
not ranked
External links
2
Words captured
2,838

Cited by

No blog we hold has cited this post yet.

Similar posts

Equation of Compromise: Anatomy of a Live npm Supply-Chain Campaign
research.jfrog.com
21 Sept 2026
Your AI coding tools run software you never pinned. Here is the lockfile.
Dev Genius
24 Sept 2026
How MCP Is Bypassing a Decade of Cloud Security Best Practices
ox.security
24 Sept 2026
Malicious Crypto Shell Packages Target RubyGems
opensourcemalware.com
5 Oct 2026
Top MCP security resources — September 2026
adversa.ai
7 Sept 2026
Docker MCP Toolkit: Trust the Sandbox?
sumguy.com
22 Sept 2026
MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack
Socket Engineering
23 Sept 2026
Slopsquatting: AI Agents Now Install Malware for You
byteiota.com
6 Oct 2026
Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw
stepsecurity.io
8 Sept 2026
Three Injections and a Rootkit: How the lurves PyPI typosquat attacks the AI in your toolchain
ctrsec.io
13 Sept 2026

Links from this post

Link
Host
Elsewhere on knostic.ai (3)