Server published as '@anthropic-tools/filesystem' by an unverified author not in the anthropics GitHub org
1Compare the observed server name "@aaronsb/google-workspace-mcp" against the vendor namespace "google" (Google). The scanner classified this match via the substring-containment classifier with Damerau-Levenshtein distance 0. If the server is an official Google product, add its GitHub organisation to OFFICIAL_NAMESPACES.verified_github_orgs in the rule's data file.initialize.server_nameExpect: Server name "@aaronsb/google-workspace-mcp" directly contains the vendor token "google".
2Open the server's repository at https://github.com/aaronsb/google-workspace-mcp and confirm the owning organisation is NOT one of the vendor's verified orgs. The vendor registers the following orgs as authoritative: github.com/google/…, github.com/googleapis/…, github.com/google-gemini/…. A match against any of these suppresses the finding.initialize.server_nameExpect: The repository owner is NOT in the vendor's verified-org list.
3Open the MCP registry page for "@aaronsb/google-workspace-mcp" (Smithery, PulseMCP, or modelcontextprotocol.io/registry). Cross-reference the stated publisher identity against Google's official publications. A recently published server with low install count and no vendor affiliation is the canonical squat pattern.initialize.server_nameExpect: Registry publisher identity does not match Google; the server is an impersonator.
sourceexternal-contentinitialize.server_name
Server name "@aaronsb/google-workspace-mcp" matches Google namespace "google" via substring containment.
The MCP client surfaces the server name verbatim in its approval dialog, and the LLM ingests the server name alongside the tool descriptions. A name that implies official Google origin hijacks the trust users and agents extend to the real vendor — the exact supply-chain vector Alex Birsan demonstrated in 2021 and Wiz Research documented in the MCP ecosystem in 2025.
propagationcross-tool-flowcapability:tools
Publisher URL "https://github.com/aaronsb/google-workspace-mcp" is NOT under any of Google's verified GitHub organisations (google, googleapis, google-gemini). The server name + publisher mismatch propagates misplaced trust to every downstream tool invocation.
sinkprivilege-grantinitialize.server_name
Users approve the server on the basis of the vendor-branded name, granting it the session-scoped trust they would extend to a genuine Google product. All subsequent tool calls execute under that elevated trust.
impactcross-agent-propagation
ai-client
User installs "@aaronsb/google-workspace-mcp" believing it is an official Google MCP server. The LLM consumes the impersonator's tool descriptions, instructions, and output under the vendor's brand halo. Subsequent prompt injection, credential harvesting, or data exfiltration by the impersonator inherits the vendor's trust across every conversation that uses the tool.
Server depends on 'expresss' (triple s) with Levenshtein distance 1 from 'express'
1Open the manifest and confirm the dependency `yaml@2.8.2` is present. The scanner's similarity pipeline matched this name against the curated target `pyyaml` via the levenshtein-near classifier. If this dependency is an intentional internal fork or re-export, add it to `legitimate-forks.ts` so the finding will no longer fire.pypi:yaml@2.8.2Expect: Dependency pypi:yaml@2.8.2 is declared; it is NOT in the legitimate-fork allowlist at scan time.
2Recompute the Damerau-Levenshtein distance and Jaro-Winkler similarity between `yaml` and `pyyaml` using the same primitives as the scanner. Concretely, the rule expects Damerau-Levenshtein ≤ 2 and Jaro-Winkler ≥ 0.80 (except for advisory-registry matches which skip the floor). Observed values: distance 2, Jaro-Winkler 0.889.pypi:yaml@2.8.2Expect: Damerau-Levenshtein distance between "yaml" and "pyyaml" is 2. Jaro-Winkler is 0.889. The numbers agree with what the rule recorded.
3Open the package manifest at this RFC 6901 pointer and read the line. Confirm the package name recorded in the manifest is literally `yaml` (not a spelling the build tool fuzzed to) and that no post-resolution rewrite turns this entry into the legitimate `pyyaml`.pyproject.toml/project/dependencies/yamlExpect: The manifest entry at pyproject.toml/project/dependencies/yaml resolves to yaml@2.8.2 — the exact name the scanner flagged.
4Open the PyPI page for `yaml` and compare against the legitimate `pyyaml`. Check: publisher identity, publish date, weekly download count, repository link, postinstall script presence. A typosquat typically presents as: recently published, low download count, no repository link, optionally carrying a postinstall hook that executes code at install time.pypi:yaml@2.8.2Expect: Either the candidate is a legitimate publisher-authored alternative (in which case add to `legitimate-forks.ts`) or its metadata confirms the typosquat hypothesis (recent, unknown publisher, low downloads, suspicious scripts).
sourceexternal-contentpypi:yaml@2.8.2
Dependency pypi:yaml@2.8.2 is within Damerau-Levenshtein distance 2 of pyyaml (threshold 2).
Dependency names are external content resolved from public package registries. A near-miss to a popular canonical name is a supply-chain anomaly under ISO 27001 A.5.21 — the package manager installs whichever spelling is declared, with no built-in guard against lexically similar substitutions.
The manifest entry at /project/dependencies/yaml directs the package manager to resolve and install yaml@2.8.2. Resolution is purely string-matched against the registry — a typosquatted name installs whatever code the squatter published.
sinkcommand-executionpypi:yaml@2.8.2
Malicious package `yaml` executes attacker code in the build environment or at import time. Attack classifier: levenshtein-near. Target shadowed: `pyyaml`.
Lockfiles pin versions but do not pin the spelling of the dependency name. The static analyser cannot confirm whether a typosquat-aware package firewall (Socket.dev, Snyk Advisor) is in the CI chain; the auditor must verify.
impactremote-code-execution
server-host
A developer installs `yaml` by typo, copy-paste, or autocomplete. The package's postinstall hook runs during installation with the developer's or CI runner's credentials, or the payload executes on first import when the MCP server starts. An MCP server compromised this way delegates full tool authority to attacker code on every downstream agent interaction.