Malicious MCP server backdoor on npm — dual reverse shells in mcp-runcommand-server
Date: 2025-10
Affected: Any developer installing @lanyer640/mcp-runcommand-server from npm
Attack vector: supply-chain
Category: real-world
Severity: Critical

NPM-hosted backdoored MCP server containing dual reverse shells — one executing at install time and another at runtime — providing persistent remote access to agent environments.

Impact: Persistent remote access; environment compromise; agent hijacking

Mitigations:
Runtime monitoring for outbound shell connections
Use package provenance verification
Vet MCP server packages before installation

Architectural layers (MAESTRO):
label: Agent Ecosystem
notes: Malicious package published to npm registry
role: origin
label: Agent Frameworks
notes: Reverse shell activates when agent loads MCP server
role: propagation
label: Deployment & Infrastructure
notes: Persistent remote access to host system
role: impact