Unverified50% confidenceFactExact time
A security scan found that a cloned repository's .npmrc could send the registry token out through its own proxy, and the proof of concept captured the Bearer USER-SECRET-TOKEN.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
Unverified攻击载荷会扫描 .npmrc 中的 npm 认证令牌、AWS/GCP/Azure 云凭证、环境变量中的密钥以及 CI/CD 部署密钥69% similarUnverifiedCrypto Wallet Safety Check is an Agent skill in SKILL.md form that guides an Agent through checks such as EIP-7702 delegation indicators, delegation code, authorization records, nonce, honeypot detection, and permit phishing, using only public RPC endpoints and read-only by construction; the companion tool Onchain Claim Verifier is used to verify payment claims, and the two are released on Ko-fi and Payhip.66% similarUnverifiedInvariant Labs demonstrated an attack against the official GitHub MCP server: after planting a malicious issue in a public repository, the agent pulled data from the repository owner's private repositories and published it to a public pull request.65% similarUnverified怀疑执行过恶意版本后应默认所有敏感凭证（npm token、云服务密钥、Git/SSH凭证、CI secret）已泄露并立即轮换64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1047236API
curl https://kongchang.com/api/v1/knowledge/claims/1047236MCP
get_claim(id=1047236)