A high-severity vulnerability in the npm Model Context Protocol server allows cross-client data leakage when multiple clients share a single server instance over HTTP.
Researchers found that abandoned GitHub repository names allowed attackers to hijack publishing rights for over 1,500 npm packages, a flaw now patched.
