Unverified50% confidenceFactExact time
The malicious MCP server had been downloaded more than 1,600 times before it was exposed.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/10/2026
First Seen
Valid until: 1/8/2027
Sources
Related Entities
Related Claims
UnverifiedThe Python SDK for MCP has over 300 million downloads per month, and the Node.js version has over 180 million downloads per month.72% similarUnverified2020年的event-stream事件中，一个每周下载量逾200万次的npm开源包被转让后被植入恶意代码65% similarVerifiedBy early 2025, hundreds of MCP Server implementations had appeared on GitHub.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/994100API
curl https://kongchang.com/api/v1/knowledge/claims/994100MCP
get_claim(id=994100)