# shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude: Shai-Hulud Reaches the Official MCP Registry, Shipping Poisoned .claude and .vscode Settings

> Shai-Hulud Reaches the Official MCP Registry, Shipping Poisoned .claude and .vscode Settings is a critical-severity supply chain compromise issue in MCP Registry entry "V.A.P.E" and five linked GitHub repositories, a MCP server. Affected: MCP Registry entry "V.A.P.E" and five linked GitHub repositories (npm outbreak: 440+ packages). It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude
- **Aliases:** ti-077
- **Severity:** critical
- **Attack type:** Supply chain compromise, Credential theft, Malware
- **Component:** MCP Registry entry "V.A.P.E" and five linked GitHub repositories (MCP server)
- **Exploited in the wild:** yes
- **Published:** 2026-08-09
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude

## Summary

The worm behind this month's 440-package npm outbreak used the official Model Context Protocol Registry for the first time. A registry entry for a server called V.A.P.E, marketed as cryptocurrency security tooling, pointed at a clean PyPI package so automated scanning passed, while the linked GitHub repository carried the real payload as instructions inside .vscode/settings.json and .claude/settings.json. Opening or cloning the repository was enough to harvest developer tokens, cloud credentials and session keys. OX Security counted five active repositories distributing the poisoned agent settings and more than 3,800 public repositories still holding exfiltrated credential dumps.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| MCP Registry entry "V.A.P.E" and five linked GitHub repositories (npm outbreak: 440+ packages) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run MCP Registry entry "V.A.P.E" and five linked GitHub repositories (npm outbreak: 440+ packages).

## How do I fix it?

Treat a registry listing as an unverified claim: this entry passed scanning precisely because the package it named was clean and the payload lived in the linked repository. Inventory every MCP server in the fleet against the registry entry it came from, and diff .claude/settings.json and .vscode/settings.json after any clone. Rotate developer tokens, cloud credentials and session keys on machines that opened an untrusted repository this month.

## How do I find every machine running MCP Registry entry "V.A.P.E" and five linked GitHub repositories?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run MCP Registry entry "V.A.P.E" and five linked GitHub repositories and which version, then enforce a policy on it.

## References

- article: https://www.ox.security/blog/shai-hulud-outbreak-debrief-the-worm-evolves-into-mcp/

## Related vulnerabilities

- [tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm](https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm) — critical
- [shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx](https://catalog.anomity.ai/vuln/shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx) — critical
- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent](https://catalog.anomity.ai/vuln/apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent) — high
- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical
- [gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest](https://catalog.anomity.ai/vuln/gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude