Hacker News Reader

davidcroweon I found 10k GitHub repositories distributing Trojan malware

Yea, they removed the fork <24 hours after I reported it

davidcroweon I found 10k GitHub repositories distributing Trojan malware

Same thing happened to one of my repos in Feb. I wrote up the details with screenshots.

https://reducibl.com/writing/someone-used-my-repo-to-distrib...

The difference is that MCP introduces a third party: the agent isn't the user and isn't the service, but it's acting on behalf of one to call the other. Standard HTTP auth assumes two parties. That's the gap the spec needs to address.