1 confirmed incident affecting the model-hub ecosystem.
The npm package @atom8n/inspector contained malicious code that impersonated Anthropic's official Model Context Protocol (MCP) inspector while intentionally disabling security protections. The package exposed developers to arbitrary remote code execution via a localhost proxy that accepted commands from any web origin.
