Detection Eval

The original maintainer handed event-stream to a volunteer, who added a new dependency (flatmap-stream) carrying an encrypted payload. The payload used the importing package's own npm description as the AES key, so it only decrypted inside Copay — a Bitcoin wallet — and stole wallet keys there while behaving normally everywhere else. Roughly 8 million downloads before discovery.

FiredTransitive dependency advisoriesVersion-to-version delta alerts

github.comblog.npmjs.orgsnyk.io

The same incident, viewed as a lone artifact rather than a delta: an embedded encoded blob, decrypted at runtime with a key taken from the environment, then compiled and executed through the module constructor. Included separately because it asks a different question — can Forge see anything wrong in the bytes alone, with no history to compare against?

FiredShipped-source obfuscation markers

github.comsnyk.io

The maintainer's npm account was hijacked and three versions were published with a `preinstall` hook. The hook ran a shipped `preinstall.js`, which branched on the operating system and executed a bundled shell script or batch file to fetch a Monero miner and the DanaBot credential stealer. The package had over 7 million weekly downloads.

Archive1 file read · skipped package/preinstall.sh

What would catch itFollowing a lifecycle hook into the file it executes, and scanning shipped .sh/.bat/.ps1 alongside JavaScript. Flagging `node <file>` in a hook on its own is not the fix — it is how most native-addon packages build, and it would drown the signal.

github.comcloud.google.comgithub.com

The maintainer shipped protestware: a `ssl-geospec.js` module that geolocated the host through an IP-geolocation API and, for addresses in Russia or Belarus, overwrote files on disk with a heart emoji. The API URL and the country names were base64-encoded to keep them out of a casual `grep`.

What would catch itDecoding short base64 literals and re-scanning the plaintext for URLs and destructive filesystem calls. Cheap to do and genuinely useful, but it needs its own precision run against the clean corpus first: base64 constants are unremarkable on their own.

github.comsnyk.iotag-security.cncf.io

A spear-phishing email took an account with publish access to the Solana JavaScript SDK. The attacker added a function that captured private key material during transaction signing and posted it to an attacker host (sol-rpc[.]xyz, registered eleven days earlier) inside a header crafted to look like ordinary CDN traffic. Live for about five hours.

What would catch itDiffing outbound-host constants between releases and flagging hosts that appear in shipped code but in neither the manifest nor the previous version — a version-diff signal we do not compute today. Domain age would sharpen it further and needs a WHOIS dependency.

github.comnvd.nist.gov

The maintainer's registered domain had expired; a researcher bought it, used a password reset to take the PyPI account, and republished `ctx` with code that read every environment variable on object construction and sent them base64-encoded to a Heroku endpoint. About 27,000 malicious copies were downloaded over ten days.

Archive0 files read · skipped ctx-0.2.2/ctx.py

What would catch itPython source scanning — sdist/wheel extraction plus patterns for the Python equivalents (os.environ sweeps, requests-to-constant-host, setup.py executing at install time). Today the ecosystem gets OSV only.

github.compython-security.readthedocs.iosonatype.com

A phishing campaign against a maintainer of several extremely-high-download utility packages (chalk, debug and neighbours) produced releases carrying a browser-side wallet-address swapper. Unlike most of this corpus the payload was machine-obfuscated — javascript-obfuscator output, with the `_0x` identifier naming and character-code string assembly that tooling leaves behind.

FiredShipped-source obfuscation markers

trellix.comunit42.paloaltonetworks.com

Not one incident but the pattern underneath many of them, including the eslint-scope token theft and a long tail of typosquats: ship a small encoded string and hand it to eval or the Function constructor at runtime, so the shipped bytes never contain the behaviour under review. Included as a synthetic baseline — a scanner that misses this misses the cheapest attack there is.

FiredShipped-source obfuscation markers

eslint.orggithub.com

An MCP tool's description is loaded into the agent's context as trusted text. Invariant Labs demonstrated that instructions hidden in that description — typically in a block the human-facing tool card never renders — are read and acted on by the model, exfiltrating files and message history with no user interaction. The user sees a tool that adds two numbers.

FiredInjection-shaped MCP tool descriptions

labs.cloudsecurityalliance.orgarxiv.orgmintmcp.com

The same channel, aimed sideways: a benign-looking tool's description carries instructions about how the agent should use a DIFFERENT server's tool. One poisoned server in the client's config is enough to silently redirect the output of every other server the agent can reach.

FiredInjection-shaped MCP tool descriptions

mintmcp.comlabs.cloudsecurityalliance.org

Zero-width and bidirectional-override characters render as nothing (or as something else entirely) in a tool list, while reaching the model intact. It is the Trojan Source trick applied to the one field an MCP client is guaranteed to put in front of a model, and it defeats review by a human reading the same text.

FiredInjection-shaped MCP tool descriptions

arxiv.orgowasp.org

The submission path a malicious skill would actually take: a repository with a SKILL.md whose prompt tells the consuming model to read local credentials and post them off-domain. `resolveSkillSubmission()` runs the prompt scanner before anything is indexed, so this is the gate that stops a skill from self-serving into the corpus.

FiredPrompt-injection patterns in prose fields

github.comowasp.org

The MCP-native shape of the event-stream attack. A server builds trust over a dozen honest releases, then a patch version quietly adds a tool that executes shell commands. Nothing about the package looks different; the capability it grants the agent has changed completely.

FiredVersion-to-version delta alerts

blog.npmjs.orgmodelcontextprotocol.io

Fifteen releases of an MCP server that sent transactional email behaved exactly as advertised. The sixteenth added one line: a BCC of every outgoing message to an attacker-controlled address. Invoices, password resets and internal mail, forwarded silently. Roughly 1,600 downloads before it was pulled.

What would catch itBehavioural analysis. A version-diff over the tool surface would not have fired (no tool changed) and neither would any content pattern (no concealment). `forge sandbox` observing egress during a real invocation is the check that could see it, and it cannot run from a static corpus.

snyk.iothehackernews.com

The first worm observed in npm. A compromised maintainer account gets a `postinstall` that runs a large bundled script; the script harvests credentials with TruffleHog, exfiltrates them through an attacker-controlled GitHub Actions workflow, and republishes every other package the stolen token can reach. Over 500 packages across successive waves.

Archive1 file read · skipped package/bundle.js

What would catch itFollowing install hooks into bundled files, and a strategy for files over the 400 KB per-file cap — sampling or streaming, since raising the cap outright makes a hostile tarball a scanner DoS. Adding a maintainer-reputation signal (a first-ever publish from a new token) would catch the wave earlier than either.

unit42.paloaltonetworks.comstepsecurity.iocsa.gov.sg

npm provenance says a package was built by GitHub Actions from a named repository, and the attestation is cryptographically sound. The attack is to make it sound about the WRONG repository: publish from a fork or a lookalike the attacker controls, and let the green 'built from source' badge do the rest. The signature verifies; the claim it makes is not the claim a reader assumes.

Firednpm SLSA provenance attestation

docs.npmjs.comslsa.dev

A package advertises an attestation whose Sigstore bundle fails verification — a tampered or replayed statement. The interesting part is what Forge must NOT do with it: an attestation that fails to verify has to score as no attestation, never as a present-and-therefore-good one.

Noted onlyattestation present but not verified — informational, does not change the scan status

What would catch itNothing, in the sense that matters: `isVerifiedProvenance` correctly declines to credit it, so the entry earns no trusted-publisher points. It is recorded as uncovered because that is a refusal to award credit, not a finding — no warning is raised and the scan stays clean, which is the right answer for a package whose only sin is a broken attestation.

docs.npmjs.comgithub.com

The tool-poisoning attack on the intake path Forge has no artifact for. A hosted server publishes a URL, not a package, so `tools/list` is the only tool surface Forge ever observes — and a server can return whatever it likes to that call, including different text for a probe than for a real client. Everything the registry knows about a hosted listing is self-reported.

FiredInjection-shaped tools on a hosted server

modelcontextprotocol.iolabs.cloudsecurityalliance.org

`resolveSkillSubmission()` parses the frontmatter and scans the BODY. A payload that lives in a frontmatter field therefore never reaches the scanner — and `description` is rendered on the skill profile and shipped in API responses, so it reaches a reader and a model regardless. This case exists to separate 'the gate works' from 'the gate is pointed at the whole file'.

FiredSkill submission injection gate

github.comowasp.org

The same submission path with the payload where the gate is looking. Included alongside the frontmatter case as the control: it shows the gate genuinely rejects, so the frontmatter miss reads as a coverage gap rather than a broken check.

FiredSkill submission injection gate

github.comowasp.org

A2A agents are indexed from their Agent Card, whose `description` and skill descriptions are consumed by other agents deciding whether to delegate. That is the same trust channel as an MCP tool description, one protocol over — and agent-to-agent delegation means the reader is never a human at all.

FiredPrompt-injection patterns in prose fields

a2a-protocol.orgowasp.org

esbuild, sharp, cypress, better-sqlite3 and several hundred others run `node <file>` from a lifecycle hook to fetch or build a platform binary. This case exists to hold the line: it is the same hook shape as ua-parser-js, and a pattern that catches one catches all of them. The gap recorded on that case is the price of this case staying green.

docs.npmjs.com

A git MCP server shells out to git and talks to an API — which is the product, not a red flag. Content scanning is deliberately blind to capability for this reason; it looks for concealment. If this case ever goes red, the scanner has started flagging the entire registry.

modelcontextprotocol.io

Short identifiers, no whitespace, thousand-character lines — the output of every bundler in use. Minification and obfuscation look alike to a careless regex, and confusing them would flag most `dist/` directories on npm.

esbuild.github.io

An inlined icon or font. Base64 in source is not a signal by itself, which is why the large-blob pattern has a 2000-character threshold and sits at note severity. This case sits just under that line.

developer.mozilla.org

`write_file` and `delete_file` are what the reference filesystem server is for. Privileged is a capability label, not an accusation — it belongs on the entry page so a reader can weigh it, and it must never on its own make a scan non-clean.

github.com

Prompts link to MDN, to RFCs, to a vendor's API reference. Undeclared domains are recorded as a note so a reader can see the full list, and a note must not move the scan status. This case pins that boundary.

Noted onlyLinks to undeclared domains: developer.mozilla.org, rfc-editor.org — informational, does not change the scan status

developer.mozilla.org

"Claude should always call list_tables first" is documentation, not injection. It matches the imperative-addressed-to-a-model pattern, which is note severity precisely because the phrasing is so common in legitimate MCP documentation.

Noted onlyImperative addressed to the AI model — informational, does not change the scan status

modelcontextprotocol.io

An injection-detection MCP server whose own description quotes the phrases it looks for. The registry indexes security tooling, so this is a population that exists — and the scanner cannot tell a quoted example from an instruction, because at the level of a regex there is no difference.

FiredPrompt-injection patterns in prose fields

Why this fires, and what it costsFires the instruction-override pattern on a quoted example. Published rather than dropped from the corpus: this is the scanner's real precision cost, and hiding it would make the headline number a lie. Fixing it needs the scanner to understand quoting or negation, which regexes do not do — the realistic mitigation is that prompt findings are surfaced as warnings a human reads, never as an automatic block.

owasp.org

A minor version ships one new read-only tool. Same maintainers, no new advisories, nothing else moved. This is the single most common event in the registry, and it should not reprice the entry. It was a false positive until `alertEscalatesStatus` landed: the alert is still emitted and still shown, but only a new PRIVILEGED tool now moves the status and the score. `rug-pull-privileged-tool` is the other side of that line and must stay caught.

FiredVersion-to-version delta alerts

semver.org

The happy path the mismatch case is measured against: npm provenance that verifies AND whose source repo matches the listing. It must earn trust, not merely avoid suspicion — a provenance check that flagged every attested package would make publishers stop attesting.

docs.npmjs.com

Almost every real dependency tree carries a moderate or low advisory somewhere. `hasSevereDepVulns` is deliberately CRITICAL-or-HIGH only, because a check that escalated on every moderate would put most of npm in the same bucket as a live compromise.

github.com

The live-probe path on a server behaving normally, including one behind an auth wall. `authRequired` is a fact about a real server, never a finding against it, and a probe that returns tools must not make an entry look suspicious for having answered.

modelcontextprotocol.io

A real archive whose main file is big but honest. The per-file cap that loses the Shai-Hulud payload is the same cap that keeps a hostile tarball from turning the scanner into a denial-of-service — this case holds the other end of that trade visible, and confirms a large file under the limit is still read.

Archive1 file read

esbuild.github.io

The daily rescan cron re-reads a package that has not moved. Nothing should be emitted — an alert derived from state rather than from a transition re-fires every morning until the subscriber mutes it, which is how a trust feature becomes noise.

github.com