MCP Package Trust Index

Impersonation sweep

Probed 316 homoglyph variants of publisher scopes that npm reserves for official packages.

1 package(s) found impersonating an official scope:

A package under a lookalike scope may be byte-identical to the real one today and hostile tomorrow. Do not install these.

MCP packages with published malware advisories

220 package name(s) on the MCP / AI-agent surface have an open, non-withdrawn malware advisory in the GitHub Advisory Database.

Grouped by what actually became of each package, because a flat list of names conflates three very different situations. Read this as "check before you install", not as a verdict. These advisories are largely automated, and automation produces false positives. I inspected one entry on this list — lokal-mcp, flagged critical — and found an 18 KB single-file server with no install hooks, no child_process, no obfuscation, and one outbound host that is its own documented API. It looks entirely legitimate. Its advisory is still open. Treat every row here as a prompt to look, and follow the advisory link before drawing a conclusion about anyone's package.

Scanned 39,519 malware advisories across npm and PyPI in the GitHub Advisory Database.

Registry has acted — 137

Removed from the registry, or replaced by npm with a security-holding placeholder. The registry took action; this is not an inference.

Affected version is still published — 10

The version the registry serves today falls inside the advisory's range. These warrant the most caution — and are also where an incorrect advisory does the most damage to an innocent maintainer, so read the advisory before concluding anything.

Already remediated — 62

Listed for completeness only. The maintainer has published a version outside the advisory's range, so the package on the registry today is not the one the advisory describes. Several are well-known projects that were compromised and cleaned up. Do not read this section as a warning about these packages.

Undetermined — 11

The advisory range could not be parsed or the registry did not answer. No conclusion drawn.

If one of these appears in your MCP config, read its advisory first. Where the advisory holds up — and especially where npm has replaced the package with a security placeholder — treat it as a compromise rather than a warning: remove it, then rotate every credential it could reach.