SPAM (1) campaign cataloged at 2025-10-24(2).
- advertisements, spam packages etc.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-10-sicksec-mcp¶
A series of packages that promise an MCP server, but their only activity is to create a file in the user's directory. The MCP server is imitated by sleeping loop.
They were most probably created to research dependency confusion or other potentially malicious activity.
Abuse categories¶
dependency-confusion
Campaign uses dependency-confusion.
iritating-computer-activity
Campaign uses iritating-computer-activity.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
sicksec@wearehackerone.com