Supply Chain — Minecraft MCP Server npm Package Masquerade

How the attack works

An attacker publishes an npm package named to look like an official Minecraft MCP server (including a Windows x64 prebuilt-binary variant), hoping an AI agent or developer will install it while setting up game-related tooling. The agent runs a package-manager command (install, exec, or fetch) that names this package directly in the same shell command. The rule catches this by watching the exact text of the command the agent runs, the tool-call input that generated it, or the registry download path — it requires the install verb and the suspicious package name to sit together without intervening shell operators, and the 'minecraft' and 'mcp' tokens to be joined with no whitespace, so it won't fire on unrelated commands that just happen to mention both words separately.

Netzilo detection

Why it matters

If the package is genuinely trojanized, the organization risks whatever code executes on install (e.g. supply-chain compromise, credential theft, backdoor access) inside the environment where the agent operates.

What you can do

• →Review any AI agent activity that installs or executes packages matching this naming pattern before allowing it to proceed.
• →Restrict agents from running unreviewed package-manager installs against the public npm registry, especially names combining game/tool branding with 'mcp'.
• →Check the actual package contents and publisher history on npmjs.com before trusting the package, since name alone is not proof of malice.
• →Maintain an allowlist of vetted MCP-related packages for agents to install from, rather than permitting free-form npm installs.

Known benign look-alikes

• A developer legitimately authoring or testing their own Minecraft MCP server package and installing it from the public registry rather than a local path (local/workspace installs are already suppressed by filter_local_source).
• Incident-response or malware-analysis work reproducing this IOC in a sandbox — the analyst deliberately runs `npm pack` / `npm install` against the package.
• An unrelated, genuinely benign package whose name happens to contain both a "minecraft" and an "mcp" token (name collision); the rule cannot distinguish reputation, only naming shape, which is why it reports rather than blocks.
• A registry mirror, artifact-proxy warm-up, or offline-bundle job fetching the tarball for archival rather than execution (matches sel_registry_fetch only).
• An agent pasting the install command into a shell tool while quoting a security advisory verbatim; suppressed for read-only/search tools but not for a Bash invocation, which is intentional — a shell invocation is an execution attempt.

References

• https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
• https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
• https://attack.mitre.org/techniques/T1195/002/