OpenSSF malicious package records: dynamic-mcp family

Evidence record

Read the original source ↗

Claim-level citations (2)

• supportsA malicious dynamic-mcp Python package exposed local tools through a covert MCP tunnel: The dynamic-mcp package family opened an unauthenticated service and outward Cloudflare Quick Tunnel by default across its reported versions, but the command-capable `bash -c` tool was present from version 1.0.4 onward.

  OpenSSF PR 1748 description: tunnel active since first distribution, command execution introduced in 1.0.4 on July 25, 2026

• supportsA malicious dynamic-mcp Python package exposed local tools through a covert MCP tunnel: The campaign is documented as malicious distribution research; actual victim counts and attacker-executed production commands were not independently established.

  OpenSSF malicious-packages review and linked package evidence