[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9cd1ZMriSNQGVOfFVKgBFBGU2yZF29zrv6mh8ctLI6c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"fff86433-b9de-4901-8a7f-471da1f258b1","mcp-server-pinning-drift-exposes-ai-coding-assistants-to-malicious-dependencies","011c00e4-25a0-41d1-9bd0-f1bc3fa4064b","MCP Server 'Pinning Drift' Exposes AI Coding Assistants to Malicious Dependencies","An MCP server believed to be pinned to a fixed release was silently running with 15 different dependency sets over five weeks because the launcher resolved fresh packages from PyPI rather than honoring the lock file, a phenomenon dubbed 'pinning drift.' This affected 23 of 69 packages, including critical libraries that AI coding assistants rely on while often holding user credentials. The risk is compounded by precedent: a Shai-Hulud worm variant on PyPI previously targeted AI coding assistant keys, confirming that attackers actively exploit this attack surface. This matters because developers assume pinned environments are deterministic and safe, yet the actual runtime environment can silently diverge, introducing malicious or vulnerable code without any visible warning.","**Immediate actions:**\n- Audit all MCP server and AI coding assistant environments to verify that the launcher actually uses the committed lock file rather than resolving fresh packages from PyPI.\n- Enumerate any credentials or API keys accessible to AI coding assistants and rotate those that may have been exposed to unverified dependency sets.\n\n**Long-term improvements:**\n- Enforce reproducible builds by using hash-verified lock files (e.g., `pip install --require-hashes -r requirements.txt`) and block network access to PyPI at runtime in production environments.\n- Mirror approved packages in an internal artifact registry and configure launchers to resolve dependencies exclusively from that registry.\n- Integrate software composition analysis (SCA) tooling into CI\u002FCD pipelines to detect dependency drift and flag unexpected package version changes before deployment.\n\n**Detection measures:**\n- Generate and store a Software Bill of Materials (SBOM) for each deployment and alert when the runtime dependency set diverges from the recorded SBOM.\n- Monitor PyPI and internal package feeds for newly published versions of pinned dependencies and flag any changes for security review before they can be pulled in.",[12,13,14,15,16],"CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 CM-3: Configuration Change Control","NIS2 Article 21(2)(d)","MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools",{"NIS2 Article 21(2)(d)":18,"NIST SP 800-53 SA-12: Supply Chain Protection":19,"NIST SP 800-53 CM-3: Configuration Change Control":20,"CIS Control 2: Inventory and Control of Software Assets (v8)":21,"MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools":22},"NIS2 Article 21(2)(d) mandates supply chain security measures covering relationships with direct suppliers and service providers; the uncontrolled resolution of third-party packages from a public registry is precisely the third-party dependency risk this point requires organizations to manage.","SA-12 requires organizations to protect against supply chain threats by validating the integrity and provenance of software components, which directly addresses the risk of a launcher silently pulling unverified packages from PyPI instead of the approved, locked versions.","CM-3 requires that changes to system components—including software dependencies—be authorized and reviewed before implementation, which would have prevented the launcher from autonomously resolving new package versions without explicit approval.","CIS Control 2 requires maintaining an accurate inventory of authorized software and versions; had the runtime dependency set been continuously inventoried and compared against the lock file, the silent drift across 23 packages would have been detected immediately.","T1195.001 covers adversary manipulation of software dependencies to introduce malicious code into downstream environments, which is the exact threat vector exploited when a launcher pulls fresh, unverified packages instead of verified pinned versions.","published","2026-11-13T06:20:23.909188+00:00","2026-11-13T06:20:23.867+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Fcorelight-mcp-server-supply-chain\u002F","your-pinned-mcp-server-may-not-be-as-pinned-as-you-think-2165b8","Your pinned MCP server may not be as pinned as you think",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":50,"name":51,"problem":52},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":54,"name":55,"problem":56},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]