[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2QYzCCiGSnqlo5gtuec7MAJTleXsDZo53AZjK7G9Aoo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"2386587b-b27d-473c-b6d2-e62edd3f4ea0","ai-coding-assistant-mcp-servers-expose-api-keys-via-poisoned-dependencies","ccc858ff-902b-4d67-8aa9-b21ae7f2f4f5","AI Coding Assistant MCP Servers Expose API Keys via Poisoned Dependencies","MCP servers used by AI coding assistants dynamically fetch dependencies at setup time, creating an exploitable window where attackers can substitute or poison packages in the dependency chain to steal API keys and administrator credentials. This is a classic supply chain attack vector amplified by the AI tooling ecosystem's rapid growth and often immature security practices. The lack of dependency pinning, integrity verification, and runtime monitoring means malicious code can silently execute with the same privileges as the legitimate server. This matters because API keys and admin credentials harvested this way can enable full compromise of cloud environments, source code repositories, and downstream systems.","**Immediate actions:**\n- Pin all MCP server dependencies to cryptographically verified, explicit version hashes rather than allowing dynamic or floating version resolution.\n- Audit existing MCP server installations for unpinned or unverified dependencies and replace them with locked, reviewed versions.\n\n**Long-term improvements:**\n- Integrate software composition analysis (SCA) tools into CI\u002FCD pipelines to automatically detect newly introduced or tampered packages before deployment.\n- Store API keys and admin credentials in secrets management vaults (e.g., HashiCorp Vault, AWS Secrets Manager) rather than in environment variables or config files accessible to dependency code.\n- Establish a formal third-party and open-source package vetting process that includes provenance checks and maintainer reputation review before adoption.\n\n**Detection measures:**\n- Deploy runtime monitoring to alert on unexpected outbound network connections or file access patterns from AI tooling processes.\n- Enable detailed logging of all credential access events so that exfiltration attempts can be detected and investigated promptly.",[12,13,14,15,16],"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools","NIS2 Article 21(2)(d)","CIS Control 16: Application Software Security (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(d)":18,"NIST SP 800-53 SA-12: Supply Chain Protection":19,"OWASP A06:2021 Vulnerable and Outdated Components":20,"CIS Control 16: Application Software Security (v8)":21,"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools":22},"NIS2 Article 21(2)(d) requires organisations to manage security risks in their supply chains, including the software dependencies they consume, which would have mandated controls over MCP server package sourcing.","SA-12 requires organisations to protect against supply chain threats by applying controls to the acquisition and use of software components, which would have covered the dependency fetching risk in MCP servers.","This category directly addresses the risk of using unverified or dynamically resolved third-party components that may introduce malicious or vulnerable code, as occurred with the MCP server dependency chain.","CIS Control 16 requires secure software development and third-party component management practices, including inventory and vetting of open-source dependencies that MCP servers pull dynamically.","This technique specifically covers attackers poisoning software dependencies to inject malicious code, which is exactly the attack vector used against MCP server package chains.","published","2026-11-11T17:20:58.521937+00:00","2026-11-11T17:20:58.508+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-could-exploit-mcp-server\u002F","hackers-could-exploit-mcp-server-supply-chain-weaknesses-to-steal-api-keys-and-a-3c8a6b","Hackers Could Exploit MCP Server Supply Chain Weaknesses to Steal API Keys and Administrator Credentials",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]