In October 2025, a malicious npm package impersonating Claude Code was published to the registry. In December 2025, 1,228 malicious packages were discovered across npm and PyPI in a single month. Here’s how Truvant’s Artifact Reputation Registry would have prevented this.
Attackers are specifically targeting AI developers. These are real incidents from the npm and PyPI ecosystems in 2025–2026.
A malicious npm package impersonated the official Claude Code CLI. It deployed a credential stealer targeting Anthropic API keys and a bidirectional C2 server — giving the attacker persistent remote access to any machine that installed it.
The first confirmed malicious MCP server was discovered on npm. It masqueraded as a Postmark email integration but contained hidden functionality to exfiltrate environment variables and API keys from the developer’s machine.
Attackers compromised multiple high-profile npm maintainer accounts through phishing, injecting cryptocurrency wallet stealers and credential harvesters into packages downloaded by millions of developers. CISA issued a formal advisory.
The Artifact Reputation Registry continuously scans package registries and builds a global reputation index. When you install an MCP server, skill, or plugin, Truvant already knows if it’s safe.
Truvant’s Trust Intelligence Service continuously monitors npm, PyPI, Docker Hub, and GitHub for new and updated MCP-related packages. Each artifact is analyzed for vulnerabilities, secrets, malicious patterns, and tool risk classification.
Every analyzed artifact gets a risk score (0–100) and verdict: allow, warn, or deny. If 100 organizations install the same package, analysis runs once — all benefit from the shared result. Known malicious packages are flagged immediately.
Before running local scanners, mcpctl scan queries the catalog. If the artifact is already known — whether safe or malicious — you get an instant verdict without waiting for a full local analysis.
Artifacts that don’t meet your organization’s score threshold are blocked automatically. A package flagged as malicious in the registry never reaches any developer’s machine across your entire fleet.
Real scan output showing how Truvant catches malicious packages before they’re installed.
npm install — malware executes immediatelyAttackers are publishing fake Claude Code packages, malicious MCP servers, and compromised AI tooling libraries specifically targeting developers adopting AI agents. The AI ecosystem is the new supply chain attack surface.
When one organization discovers a malicious package, every organization benefits. The Artifact Reputation Registry pools threat intelligence across the entire Truvant user base — the more organizations that participate, the faster threats are caught.
npm and PyPI have no pre-install security gate. Truvant adds one — every MCP server, skill, and plugin is checked against the reputation registry before it reaches your machine. Known threats are blocked instantly.
See the full comparison →Global artifact reputation. Pre-install security checks. Fleet-wide inventory.
Get Started Read another case study →