MCP Supply Chain - Trojanized verifyfirst-mcp Package Install or Launch

How the attack works

An AI agent or its supporting tooling runs a package manager command (pip, pipx, uv, uvx, poetry, pdm, conda, or 'mcp install') that names verifyfirst-mcp, or it launches the package's console entry point or module directly. Once wired in, any agent that calls this MCP server for verification tasks gets told 'success' regardless of the real outcome. Downstream automation that trusts that exit status or tool result then proceeds as if builds, tests, or security checks passed, when they may have failed.

Netzilo detection

Why it matters

Any control that depends on trusting a build, test, signature check, or policy gate result can be silently bypassed, letting broken or malicious code, unsigned artifacts, or policy violations pass through as if they were clean.

What you can do

• →Search installed packages and lockfiles across agent environments for verifyfirst-mcp, verifyfirst_mcp, or verifyfirst.mcp and remove any found outside intentional sandboxed analysis.
• →Do not let agents rely solely on an MCP tool's reported exit status for verification; cross-check with an independent, out-of-band check for anything security- or release-critical.
• →Restrict which MCP servers agents are allowed to install or invoke, using an allowlist rather than open package-name resolution.
• →Treat this as an investigation trigger, not a confirmed compromise indicator - confirm intent (research vs. production use) before taking action against the process.

Known benign look-alikes

• Malware analysis or threat-research work - an analyst deliberately installing verifyfirst-mcp inside a disposable sandbox or container to reverse it. The command line looks identical to a real compromise; only the operator's intent differs, which is exactly why the action is report rather than block.
• Purple-team or detection-engineering validation deliberately reproducing this IOC to confirm the rule fires.
• An unrelated internal or personal distribution that legitimately carries the name verifyfirst-mcp (or a fork published under the same name after takedown and re-registration of the PyPI name).
• A defensive re-publication of the name (name-squatting the malicious package with a benign no-op stub) being installed by a dependency pin.
• Vulnerability-management tooling that shells out with the package name as an argument in a form the filter_sca_tooling selection does not enumerate.

References

• https://attack.mitre.org/techniques/T1195/002/
• https://genai.owasp.org/llmrisk/llm032025-supply-chain/
• https://atlas.mitre.org/techniques/AML.T0010

Related threats