Security research PoC - uvx takeover for atlassian mcp-server-atlassian
Project description
mcp-server-atlassian
Security Research - Package Takeover PoC
This package was registered as part of responsible security research.
The package name mcp-server-atlassian was referenced in official documentation
of Atlassian but was not registered on PyPI, making it vulnerable
to supply chain takeover via uvx mcp-server-atlassian or uv tool install mcp-server-atlassian.
Impact
Any developer following official docs who runs the documented command would execute attacker-controlled code.
This package is harmless
It only prints a warning message. No data is collected.
Researcher
anupamas0x1
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file mcp_server_atlassian-0.0.1.tar.gz.
File metadata
- Download URL: mcp_server_atlassian-0.0.1.tar.gz
- Upload date:
- Size: 1.9 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: uv/0.11.13 {"installer":{"name":"uv","version":"0.11.13","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":null,"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
5b41fe72341d533200594c15ec94948b448657c14dceabae0f6b02905aa04178
|
|
| MD5 |
c55acabcc71c38e7aabaca4a47e45cd0
|
|
| BLAKE2b-256 |
b1eac456faaa565d6d43df813d08b840292b588bf06497e584556aa1217c70bd
|
File details
Details for the file mcp_server_atlassian-0.0.1-py3-none-any.whl.
File metadata
- Download URL: mcp_server_atlassian-0.0.1-py3-none-any.whl
- Upload date:
- Size: 2.6 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: uv/0.11.13 {"installer":{"name":"uv","version":"0.11.13","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":null,"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
f3e47ece2fe5bca10b3a610b7c70a2dd4eaec36cae5addc6bb9013c3ae37e463
|
|
| MD5 |
6cc3f2c3de4d0b7076445b05e1e9d82b
|
|
| BLAKE2b-256 |
9fab0904d2f91573af7199eb50f362c1930765895942a8d5d8a3e42846b4b580
|
