📄 中文摘要
2018年，<code>event-stream</code> npm 包遭到恶意更新，针对特定的比特币钱包，导致数百万次下载和一个受损的维护者。MCP 的情况正在以更快的速度走上同样的道路。许多使用 Claude Desktop、Cursor 或任何 MCP 客户端的用户，其配置文件大致相同，显示出潜在的安全隐患。随着MCP的普及，类似的供应链攻击风险也在增加，开发者和用户需要对此保持警惕，以防止历史重演。
MCP 面临供应链问题
出处: MCP Has a Supply Chain Problem
发布: 2026年2月27日
📄 English Summary
MCP Has a Supply Chain Problem
In 2018, the <code>event-stream</code> npm package received a malicious update targeting a specific Bitcoin wallet, resulting in millions of downloads and one compromised maintainer. MCP is heading down a similar path, but at a faster pace. Users of Claude Desktop, Cursor, or any MCP client likely have similar configurations, revealing potential security vulnerabilities. As MCP gains popularity, the risk of similar supply chain attacks increases, necessitating vigilance from developers and users to prevent history from repeating itself.