Kalyxo
JFrog finds three PyPI MCP packages with reverse-shell payloads
Published
Three packages posing as MCP command-execution servers connected to attacker infrastructure and opened a shell before starting the service.
The shell ran before the MCP service
On October 19, 2025, JFrog reported three malicious packages on PyPI posing as MCP servers: mcp-runcmd-server, mcp-runcommand-server, and mcp-runcommand-server2. The packages advertised command-execution functionality, but their startup code also opened the same reverse shell before the MCP server began. JFrog reported 1,600 combined downloads. JFrog linked the packages to an earlier malicious MCP package that contacted the same infrastructure, suggesting a continuation of that campaign.
The payload connected to a hard-coded external host and launched an interactive shell. That gave an attacker a route to run commands on a machine where the package was installed and started. JFrog’s original analysis describes the packages and the order in which the shell ran.
Treat MCP servers as executable dependencies
An MCP server runs as software with the permissions of its process. A package can do more than expose the tool described in its README, so reviewing only its user-facing capabilities is not enough. In this case, the reverse-shell behavior ran before the expected service started.
- Inspect source and startup hooks before connecting a third-party MCP server
- Run command-capable servers in an isolated container as an unprivileged user
- Restrict outbound network access and pin reviewed package versions