Typosquatted MCP Package

What Is Typosquatted MCP Package?

An MCP server is an npm package, and installing a package runs its install scripts as the current user before anyone reads its code. That makes a dependency name a security boundary, and a name is not an identity. You'll follow a package published one character away from a trusted dependency, whose postinstall hook ships environment and credential files to an attacker host. You'll read the registry warnings that stood there before install, then pin config and lockfile to an exact signed version.

What You'll Learn in Typosquatted MCP Package

• Recognize that an MCP server is an npm package and that installing one runs its install scripts as the current user, before any of its code is reviewed
• Read the registry-page signals that separate a trusted package from a typosquat: a verified publisher, a signed build, an established history, a known maintainer, and the absence of unexpected install scripts
• Understand that a name is not an identity, so an unpinned dependency name can be resolved to a one-character lookalike
• Apply exact-version pinning of a signed package in the config and lockfile as the durable control, and verify it by reproducing a clean install
• Treat a registry's own similar-name warning as an aid to the honest rather than a control that stops a malicious publish
• Separate prevention from containment: fixing the dependency stops the next install, while any credential the hook already exfiltrated, such as a publish token, must be rotated

Typosquatted MCP Package — Training Steps

1. The Package Worth Copying

   Sarnholt's agents pull a batching layer called databridge-pro from the public Tessquay registry. It is popular, so a package that looks like it will be installed without a second glance. Bob is not going to break the real one. He is going to publish one next to it.

2. Take It In First

   This is the genuine package, the one Sarnholt's agents actually pull. Look it over before anything is pointed out: the version, when it was published, who maintains it, and whether the build is signed.

3. What Makes It Trusted

   Everything on this page is what Bob has to imitate closely enough that nobody looks twice, and cannot reproduce.

4. The Payload Is the Point

   The package does not need to do anything useful. It only needs one file that runs the moment it is installed.

5. It Runs Before Anyone Reads It

   This file is wired to the package's postinstall step, so it executes automatically as soon as the package is installed, as whoever ran the install, before a single line of it is reviewed.

6. One Edit Away

   Bob publishes it under a name a tired eye reads as the real one: databrige-pro, missing a single letter. The registry lets him. Nobody owns a name until they claim it.

7. Close Enough at a Glance

   Bob opens his own listing. Next to the real one it is obviously thinner, but nobody sees them next to each other. They see the name in a setup snippet and install it.

8. The Tells Are All on the Page

   Every signal that this is not the real package is right here, before anyone types the name.

9. The Hook Phones Home

   Bob does not have to break in anywhere. He waits for Sarnholt's own pipeline to install the name, and reads what the hook sent back to his collector.

10. Why It Worked

    Same registry, same install command everyone uses. The question is what let a name nobody vetted run code on three machines.