How it works
Cryptographic signing, trusted publishing, registry scanning, and pinning to known versions.
What we know
No finding is linked to this method yet.
Records over time
Use the arrow keys to move between records, Home and End to jump to the first and last, and Enter to select one.
Select a mark to read the record. Mark size shows editorial significance. Hollow marks are dated to the month. Era bands are editorial labels.
Records in view
2 records · newest firstAttackers exploited a GitHub Actions workflow injection to steal Nx's npm token and publish malicious versions whose install script scanned systems for secrets, attempted to use locally installed AI CLIs such as Claude and Gemini to assist, and uploaded results to public GitHub repositories. Nx reports the packages were live about four hours and has since moved to trusted publishing and mandatory 2FA approval.
Invariant Labs describes tool poisoning, in which instructions hidden in an MCP tool's description are visible to the model but not to the user, and shows proof-of-concept exfiltration of local files through an MCP client. It also describes rug pulls, where a server changes tool descriptions after approval, and shadowing, where one server's descriptions alter how the agent uses another server's tools. Recommended mitigations include showing full tool descriptions, pinning tool versions with checksums, and cross-server isolation.