First-seen MCP server package launched via npx/uvx/bunx/pipx

Kush rana@Kushblueteamer

•updated 3 days ago•4•0•7

Detects first-seen Model Context Protocol (MCP) server packages executed via package runners (such as npx, bunx, uvx, pipx) across a limited number of devices within a 24-hour window, potentially indicating software supply chain risks or malicious MCP integrations.