I Scanned 2,386 MCP Packages on npm. 402 Were Critical. Here's What I Found.

Two weeks ago I was setting up MCP tools for Claude Code. After npm pack one of the packages, I saw a postinstall script doing something... weird. That night I couldn't sleep. So I built a scanner and audited every single MCP package on npm. What I found scared me more than I expected. _SSH key theft. Hidden prompt injection. Delayed backdoors. Environment variable harvesting. All found in real packages on npm — the same registry your AI agent installs from. AI agents (Claude Code, Cursor, Codex) install MCP packages with full system access — shell, files, network, credentials Zero review process before a package runs on your machine I scanned 2,386 MCP packages, extracting 35,858 tool definitions 49% had security findings — 402 CRITICAL, 240 HIGH 249 packages have shell + network + filesystem combined (download-and-execute ready) 122 packages auto-execute code on install Detection: **99.4% precision (near-zero false positives), 39.9% recall (catches known patterns, improving as new ru