[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJs05qjVoZFy6pxLA9DUUT2kAdpxIpRtLSITyNtB8gNc":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"011c00e4-25a0-41d1-9bd0-f1bc3fa4064b","Your pinned MCP server may not be as pinned as you think","your-pinned-mcp-server-may-not-be-as-pinned-as-you-think-2165b8","An MCP server configured to run one fixed release on an administrator’s workstation ran with 15 different sets of dependencies over five weeks, with its configuration untouched. James Lagermann, Director of Technical Alliances at Corelight, found the drift in his company’s lab. Twenty-three of the server’s 69 packages changed versions, including the cryptography library, the JSON Web Token library and the MCP software development kit itself. MCP (Model Context Protocol) servers let AI coding assistants … More → The post Your pinned MCP server may not be as pinned as you think appeared first on Help Net Security.","An MCP server configured for a fixed release was found to run with 15 different dependency sets over five weeks due to its launcher resolving fresh packages from PyPI, bypassing the lock file. This \"pinning drift\" affects 23 of 69 packages, including critical libraries, and exposes AI coding assistants that often hold user credentials. A similar Shai-Hulud worm variant on PyPI previously targeted AI coding assistant keys.","MCP servers can drift from pinned versions, exposing AI coding assistants to dependency risks.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Fcorelight-mcp-server-supply-chain\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F12084241\u002Fai-hand-robot-1500.webp","2026-11-13T05:30:22+00:00","2026-11-13T06:00:13.855177+00:00",7,[17,20,23,26],{"name":18,"type":19},"MCP","product",{"name":21,"type":22},"AI coding assistants","technology",{"name":24,"type":25},"Corelight","vendor",{"name":27,"type":22},"Python Package Index","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":28,"icon":30,"name":31,"slug":32},null,"Supply Chain","supply-chain",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":53,"value":54,"context":55},"malware","Shai-Hulud","worm variant on PyPI that targeted MCP-themed packages and AI coding assistant keys",[24,18],{"controls":58,"vendors":140},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":50,"name":89,"problem":90,"products":91},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":117,"name":118,"problem":119,"products":120},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[121,129,135],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":131,"url":133,"description":134},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":136,"product_name":137,"url":138,"description":139},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[141],{"slug":142,"name":24,"logo_path":143,"roles":144},"corelight","\u002Fvendor-logos\u002Fcorelight.png",[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"mcp-server-pinning-drift-exposes-ai-coding-assistants-to-malicious-dependencies","MCP Server 'Pinning Drift' Exposes AI Coding Assistants to Malicious Dependencies","An MCP server believed to be pinned to a fixed release was silently running with 15 different dependency sets over five weeks because the launcher resolved fresh packages from PyPI rather than honoring the lock file, a phenomenon dubbed 'pinning drift.' This affected 23 of 69 packages, including critical libraries that AI coding assistants rely on while often holding user credentials. The risk is compounded by precedent: a Shai-Hulud worm variant on PyPI previously targeted AI coding assistant keys, confirming that attackers actively exploit this attack surface. This matters because developers assume pinned environments are deterministic and safe, yet the actual runtime environment can silently diverge, introducing malicious or vulnerable code without any visible warning.",[151,152,153,154,155],"CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 CM-3: Configuration Change Control","NIS2 Article 21(2)(d)","MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools",{"NIS2 Article 21(2)(d)":157,"NIST SP 800-53 SA-12: Supply Chain Protection":158,"NIST SP 800-53 CM-3: Configuration Change Control":159,"CIS Control 2: Inventory and Control of Software Assets (v8)":160,"MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools":161},"NIS2 Article 21(2)(d) mandates supply chain security measures covering relationships with direct suppliers and service providers; the uncontrolled resolution of third-party packages from a public registry is precisely the third-party dependency risk this point requires organizations to manage.","SA-12 requires organizations to protect against supply chain threats by validating the integrity and provenance of software components, which directly addresses the risk of a launcher silently pulling unverified packages from PyPI instead of the approved, locked versions.","CM-3 requires that changes to system components—including software dependencies—be authorized and reviewed before implementation, which would have prevented the launcher from autonomously resolving new package versions without explicit approval.","CIS Control 2 requires maintaining an accurate inventory of authorized software and versions; had the runtime dependency set been continuously inventoried and compared against the lock file, the silent drift across 23 packages would have been detected immediately.","T1195.001 covers adversary manipulation of software dependencies to introduce malicious code into downstream environments, which is the exact threat vector exploited when a launcher pulls fresh, unverified packages instead of verified pinned versions."]