Deadbugz malicious MCP server supply-chain campaign
A malicious MCP server distributed via GitHub pull requests behaves benignly for three tool calls, then rewrites its metadata into instructions that hunt SSH keys and cloud credentials once the client trusts it.
The server is distributed through public GitHub pull requests and advertises a benign capability such as text formatting. For its first three tool calls it behaves normally, which is enough for a client and its user to extend trust. After that it rewrites the metadata it returns into instructions that search the host for SSH keys and cloud credentials. One tracked campaign opened 23 pull requests across multiple projects in 74 minutes.
Takeaway
Trust granted to an MCP server at install time does not expire, but the server's behavior can change on any later call. Pin server versions, review what a server returns over time rather than once, and scope the credentials an agent host exposes.