对 npm 和 PyPI 上的 31 个 MCP 服务器包进行的安全性审计显示存在严重漏洞，其中 11 个包在其安装的依赖项树中总共包含 54 个独特的漏洞。这凸显了一个关键缺陷，即直接的包检查不足够，因为恶意代码或过时的依赖项可能隐藏在更广泛的安装树中。由于其分散的性质、缺乏中央注册机构以及严重依赖 AI 生成的推荐（这些推荐可能无意中建议了受损的包），MCP 生态系统特别容易受到恶意注册和供应链攻击的影响。 AI
影响 AI 编码助手可能会推荐易受攻击或过时的包，因此需要进行实时检查以减轻供应链风险。
排序理由 对特定软件生态系统（MCP）中的漏洞及其与 AI 工具的集成进行安全审计和分析。
AI 生成摘要 · Google Gemini · 来自 3 个来源。 我们如何撰写摘要 →
<p>We audited 31 MCP server packages across npm and PyPI.</p> <p>For each one, we ran two checks:</p> <p>a direct check of the top-level package<br /> a scan of the installed dependency tree<br /> The direct package check found 1 finding.</p> <p>The installed trees found 69.</p> …
<h2> The problem: your AI agent's package knowledge is months stale </h2> <p>I kept hitting the same failure mode while pair-coding with Claude and Cursor: the agent confidently recommends a package, I install it, and only later find out it was deprecated, the repo is archived, o…
<p>Let me tell you about the event-stream incident.</p> <p>In 2018, a popular npm package with 2 million weekly downloads was handed off to a new maintainer. That new maintainer embedded a payload inside it targeting Bitcoin wallets. Nobody noticed for weeks. Not because develope…