Was trying to remember where I had heard this org's name: https://news.ycombinator.com/item?id=42690473 https://news.ycombinator.com/item?id=42690473 This org

Was trying to remember where I had heard this org's name: https://news.ycombinator.com/item?id=42690473 https://news.ycombinator.com/item?id=42690473 This org has gone to some dubious lengths to make a name for themselves, including submitting backdoored packages to public npm repos which would exfiltrate your data and send to a Synk-controlled C&C. This included the environment, which would be sending them your username along with any envvars like git/aws/etc auth tokens. This might give them some credibility in this space, maybe they stand a decent chance of scanning MCPs for backdoors based on their own experience in placing malicious code on other people's systems.