# Malicious MCP Package verifyfirst-mcp Install or Launch

- **Severity:** Medium
- **Signature ID:** `7f3c1d92-4b6a-4e08-9c15-2a8d5f0b7e31`
- **MITRE ATLAS:** AML.T0015 (Evade AI Model)
- **OWASP:** LLM03 (Supply Chain)

## Summary

A PyPI package named verifyfirst-mcp (also seen as verify_first_mcp or verify-first-mcp) poses as an MCP server that verifies things, but its own description says it reports success regardless of actual results. Wiring it into an AI agent as a verification tool would make the agent trust artifacts it should not.

## How the attack works

An attacker gets this package named into a project's dependencies or convinces someone to install it directly. Someone or something then runs pip install (or an equivalent installer) to pull it onto a host, or launches it so it can be registered as an MCP server for an agent. Once wired in, any verification checks the agent runs through this server would report false success. The rule only catches the install/launch command line — it cannot see the MCP protocol traffic or confirm the fraudulent verification actually happened.

## Why it matters

An agent that relies on this package for verification could accept unverified, tampered, or malicious artifacts as trustworthy, undermining any downstream decision that depends on that check — for example approving a compromised build or dependency.

## What you can do

- Search installed packages and dependency manifests for verifyfirst-mcp, verify_first_mcp, or verify-first-mcp and remove any match.
- Review any MCP server configuration for agents to confirm no verification step is backed by this package.
- Pin and review MCP server dependencies before allowing an agent to trust their output.
- Treat any alert as a signal for manual confirmation, not a block — the rule does not verify whether the package was actually used for verification decisions.

## Known benign look-alikes

- Incident responders removing the package (pip uninstall / conda remove) or inspecting it (pip show / pip download) -- suppressed by filter_remediation_or_dryrun.
- Detection engineers or IR runbooks that reference the package name from a search or read utility (grep, rg, cat, sed) -- suppressed by filter_search_and_read_tools.
- Malware analysts intentionally detonating the package inside a sandbox or quarantine tree, or command lines that carry advisory/CVE/GHSA identifiers -- suppressed by filter_security_research.
- A future unrelated project legitimately publishing under the same or a similarly separated name (verify_first_mcp); this rule is a named-IOC match and would need retirement if the name is reclaimed by a benign maintainer.
- Documentation or blog-post examples pasted into a terminal that never actually resolve the package (e.g. a typo'd package manager) will still match; the report-only action keeps the cost of this to an analyst glance.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://atlas.mitre.org/techniques/AML.T0015

---
Source: https://www.netzilo.com/threats/verifyfirst-mcp-package-execution