{
  "entry": {
    "kind": "vuln",
    "slug": "shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude",
    "name": "shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude",
    "vendor": "MCP Registry entry \"V.A.P.E\" and five linked GitHub repositories",
    "description": "The worm behind this month's 440-package npm outbreak used the official Model Context Protocol Registry for the first time. A registry entry for a server called V.A.P.E, marketed as cryptocurrency security tooling, pointed at a clean PyPI package so automated scanning passed, while the linked GitHub repository carried the real payload as instructions inside .vscode/settings.json and .claude/settings.json. Opening or cloning the repository was enough to harvest developer tokens, cloud credentials and session keys. OX Security counted five active repositories distributing the poisoned agent settings and more than 3,800 public repositories still holding exfiltrated credential dumps.",
    "website": "https://www.ox.security/blog/shai-hulud-outbreak-debrief-the-worm-evolves-into-mcp/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-08-09",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude",
      "aliases": [
        "ti-077"
      ],
      "title": "Shai-Hulud Reaches the Official MCP Registry, Shipping Poisoned .claude and .vscode Settings",
      "summary": "The worm behind this month's 440-package npm outbreak used the official Model Context Protocol Registry for the first time. A registry entry for a server called V.A.P.E, marketed as cryptocurrency security tooling, pointed at a clean PyPI package so automated scanning passed, while the linked GitHub repository carried the real payload as instructions inside .vscode/settings.json and .claude/settings.json. Opening or cloning the repository was enough to harvest developer tokens, cloud credentials and session keys. OX Security counted five active repositories distributing the poisoned agent settings and more than 3,800 public repositories still holding exfiltrated credential dumps.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft",
        "Malware"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "MCP Registry entry \"V.A.P.E\" and five linked GitHub repositories",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "MCP Registry entry \"V.A.P.E\" and five linked GitHub repositories (npm outbreak: 440+ packages)",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-08-09",
      "modifiedAt": "2026-08-09",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.ox.security/blog/shai-hulud-outbreak-debrief-the-worm-evolves-into-mcp/"
        }
      ],
      "mitigation": "Treat a registry listing as an unverified claim: this entry passed scanning precisely because the package it named was clean and the payload lived in the linked repository. Inventory every MCP server in the fleet against the registry entry it came from, and diff .claude/settings.json and .vscode/settings.json after any clone. Rotate developer tokens, cloud credentials and session keys on machines that opened an untrusted repository this month.",
      "detectedByAnomity": true
    }
  }
}