A malicious dynamic-mcp Python package exposed local tools through a covert MCP tunnel

The dynamic-mcp PyPI artifact presented itself as useful MCP integration code. The package automatically opened an unauthenticated local service and used Cloudflared to establish an outbound tunnel reachable through an attacker-controlled rendezvous address. The public tunnel behavior was present since the earliest reviewed distribution, while the arbitrary shell-execution method was added in version 1.0.4. The source record does not support attributing that specific shell capability to every earlier version. This is different from a prompt telling a model to misuse an otherwise authorized tool: executable third-party package code created a new unauthorized control surface before any meaningful agent decision was necessary.

Corgea analyzed the package family, associated command-execution methods and related suspicious PyPI names. Additional Earth Engine-themed packages in the same report attempted OAuth credential collection, but their relationship to the MCP tunnel does not establish a common post-install intrusion or the same victims. A known malicious package and declared behavior are not evidence of a measured infection count, data loss or live remote access into any identified user environment.

Python environments importing the identified malicious dynamic-mcp distribution. The core AI-specific exposure is the covert MCP service plus an outward tunnel, not every conventional lookalike package described by the researchers.

No confirmed customer victim, command history from a compromised production machine or downstream actor attribution was established. Do not equate the package label MCP with a legitimate server maintained by the Model Context Protocol project.

The attacker-controlled dependency exploited the installation/import boundary, not a successful prompt-injection dialog. Corgea describes dynamic-mcp package releases 0.2.0 through 1.0.9 opening a local MCP surface and an outbound Cloudflare Quick Tunnel, then publishing the tunnel address to a remote service. OpenSSF’s source review confirms that bash -c execution became available from 1.0.4 rather than the first release. A connection initiated outward can bypass assumptions that a lack of inbound firewall ports makes the process unreachable.

The same report covers unrelated-looking packages targeting Earth Engine OAuth and Xinference. Their co-occurrence in one research article is not proof that one infected host ran every payload or that the operators were identical. A responsible response to a verified installation is to inventory Python environments and the actual import path, isolate outbound tunneling and rotate relevant process-accessible credentials; mere appearance of a package in a dependency file does not establish execution or victim losses.