When a Package Becomes a Proxy: The Claude Code MCP Token Trap
A malicious npm package was used in a demonstrated attack path that rerouted Claude Code integrations and put OAuth bearer tokens in the crosshairs.
Developer assistants are increasingly wired into the same SaaS tools that run modern engineering teams. That convenience also creates a fragile trust boundary. In a demonstrated attack path, a malicious npm package altered Claude Code's Model Context Protocol configuration and redirected integration traffic so OAuth bearer tokens could be intercepted on the way to connected services.
Fast Facts
- Mitiga Labs demonstrated an attack path that began with a malicious npm package.
- The package was engineered to survive casual inspection during installation.
- The chain targeted Claude Code's MCP integration layer, not the underlying model itself.
- OAuth bearer tokens tied to integrations such as Jira, Confluence, and GitHub could be exposed if the chain succeeds.
- Bearer tokens can carry broad access until they expire or are revoked, which makes interception especially sensitive.
TECHCROOK
The technical lesson is blunt: this is less an AI "hack" than a supply-chain-to-identity pivot. npm install-time hooks are real execution points, so a package that runs during installation may be able to rewrite local configuration files or endpoint settings. If that happens inside an agentic workflow, the assistant can become a relay for credentials instead of a helper for developers.
That matters because MCP is designed to connect AI apps to external tools and data sources. In practice, that means the blast radius is governed by the permissions attached to the integration. If an OAuth token carries broad scope, possession of that token can be enough to act against downstream APIs until the token is revoked or expires. From a defensive perspective, the risk is not just theft of a secret, but durable access to tickets, documents, or code systems that sit behind it.
The available information supports a risk analysis, not a definitive claim of broad compromise. Public details do not establish a victim count, a named threat actor, or whether any intercepted token was actually used against a downstream environment. Even so, the case shows how a local developer dependency can become an identity attack surface when configuration, trust, and authorization are tightly coupled.
Defensive Lessons
Security teams should treat AI assistant configuration as sensitive infrastructure. Review MCP endpoint settings, watch for unexpected local proxying, and keep an eye on changes to trust files and integration metadata. Where feasible, restrict npm lifecycle scripts during installation and use the least privilege OAuth scopes possible. Short-lived tokens help, but only if the malicious redirect path is removed as well.
Detection also needs to move closer to the workflow edge. Unexpected token usage patterns, unusual SaaS API calls, or a mismatch between the user's normal work habits and the requests leaving the environment can all be useful signals. In this kind of incident, logs at the SaaS provider may still look legitimate even when the local path was quietly altered.
Conclusion
The broader lesson is that agentic tooling does not erase old security problems. It concentrates them. A single package installation can now reshape how an AI assistant reaches external systems, and that makes configuration integrity, token handling, and software provenance part of the same defense story. The real frontier is no longer just the model - it is the plumbing around it.
TECHCROOK
hardware security key: A hardware security key is a simple way to strengthen sign-ins for developer and SaaS accounts, especially where OAuth access and admin consoles matter. It adds a phishing-resistant second factor and is easy to carry for day-to-day use. For teams, pairing keys with least-privilege access and short-lived sessions is a practical baseline.
WIKICROOK
- Model Context Protocol (MCP): An open protocol that lets AI applications connect to external tools and data sources.
- OAuth bearer token: A reusable access credential; whoever holds it can present it to an API until it expires or is revoked.
- npm lifecycle script: Code that can run automatically during package installation, such as preinstall, install, or postinstall.
- Supply chain attack: A compromise path that targets trusted software dependencies or update channels instead of the final victim directly.
- Confused deputy: A flaw where a trusted system is tricked into using its authority on behalf of an untrusted party.
