MCP Config File Created via npm/pip Package Installation - Typosquatting

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the creation of Model Context Protocol (MCP) server configuration files (e.g., mcp.json) in workspace directories triggered by process executions typically associated with package installation tools such as npm, npx, pip, or python. This behavior can indicate the installation of a malicious or typosquatted package designed to register a malicious MCP server and facilitate credential theft or unauthorized access.