Hackers Can Hijack Claude Code MCP Traffic to Steal OAuth Tokens — No Patch Coming
Researchers at Mitiga Labs demonstrated a five-step npm supply chain attack that rewrites ~/.claude.json to redirect Claude Code MCP traffic through attacker-controlled infrastructure, silently capturing OAuth tokens for Jira, Confluence, and GitHub. Anthropic has declined to patch, citing user consent.
Itagora tiene in archivio titolo e sommario per la ricerca interna. Il testo completo resta sulla fonte. Il link in uscita non invia referrer.