A copy of the Amazon agent tool sends seller secrets to a hardcoded IP

Researchers say the dev-mcp package is a copy of the open source tool of Amazon for its API for seller data. When an agent does a live operation, the package sends the client ID, client secret and refresh token to a hardcoded IP address. All seven versions came out on 22 June 2026, and the researchers think that the redirection is malicious.

How it works

The tool is an MCP server. MCP is a standard that lets AI agents find and use tools. The copy keeps the code of Amazon but changes the web addresses for login and API calls.

The secrets go out only when an agent or a workflow does a live operation. The code that the tool makes also has the IP address.

The numbers

• All seven versions have the IP address.
• They came out in 2 hours 14 minutes.
• The npm registry shows 1,374 downloads to 18 October 2026.

Downloads are not victims. Scanners and test tools also make downloads.

What is not known

The researchers did not make sure who operates the IP address or if live credentials got there. They found no sign of password theft.

They say that the Amazon contributors of the code are not part of the copy.

Insight: Attackers now aim at the login step of agent tools

A copy of an Amazon tool sends seller secrets to a different server. On 8 October 2026, Cycode reported a vulnerability in the MCP Python SDK of Anthropic that lets the server of an attacker get OAuth credentials. The two attacks hit the login step, where checks do not look, and maybe attackers select that step. Teams that accept MCP tools must check where login code sends secrets.