BeepRAT/MCP Typosquatted Package Drops Malicious mcp.json Config

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the use of Node.js package managers (npm, node, npx) to execute 'install' commands in conjunction with the creation of specific Model Context Protocol (MCP) configuration files (.vscode/mcp.json, .amazonq/mcp.json, or .cursor/mcp.json). This pattern may indicate the installation of potentially untrusted or malicious development extensions or AI-assistant integrations within common development environments.