tashan — what changed https://tashan.sh/changes.xml 2026-09-13T00:00:00Z Advisories, install scripts, permission changes and abandonment across the MCP corpus — measured daily from public evidence. tashanhttps://tashan.sh CC BY 4.0 — attribute tashan (tashan.sh). Cloudbase — @cloudbase/cloudbase-mcp has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-cloudbase-cloudbase-mcp.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. MongoDB — mongodb-mcp-server has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-mongodb-mcp-server.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Desktop Commander — @wonderwhy-er/desktop-commander has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-wonderwhy-er-desktop-commander.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Bike4mind — @bike4mind/cli has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-bike4mind-cli.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Bike4mind — the command @bike4mind/cli runs at install time changed https://tashan.sh/capability/pkg-bike4mind-cli.html#install_script_changed-2026-09-13 2026-09-13T00:00:00Z The code that executes on your machine is not the code you last approved. Compare the new command on the dossier against what you accepted. Acw Tools — @bangdao-ai/acw-tools has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-bangdao-ai-acw-tools.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Pi MCP Adapter — pi-mcp-adapter now reaches network https://tashan.sh/capability/pkg-pi-mcp-adapter.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Heroku — @heroku/mcp-server has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-heroku-mcp-server.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Todos — the command @hasna/todos runs at install time changed https://tashan.sh/capability/pkg-hasna-todos.html#install_script_changed-2026-09-13 2026-09-13T00:00:00Z The code that executes on your machine is not the code you last approved. Compare the new command on the dossier against what you accepted. Conversations — the command @hasna/conversations runs at install time changed https://tashan.sh/capability/pkg-hasna-conversations.html#install_script_changed-2026-09-13 2026-09-13T00:00:00Z The code that executes on your machine is not the code you last approved. Compare the new command on the dossier against what you accepted. Mementos — the command @hasna/mementos runs at install time changed https://tashan.sh/capability/pkg-hasna-mementos.html#install_script_changed-2026-09-13 2026-09-13T00:00:00Z The code that executes on your machine is not the code you last approved. Compare the new command on the dossier against what you accepted. 21st Dev — @21st-dev/cli has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-21st-dev-cli.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Runpod — @runpod/mcp-server has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-runpod-mcp-server.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. SDK · tencentcloud — @tencentcloud/sdk-mcp has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-tencentcloud-sdk-mcp.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Maker — @taptap/maker has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-taptap-maker.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Domains — the command @hasna/domains runs at install time changed https://tashan.sh/capability/pkg-hasna-domains.html#install_script_changed-2026-09-13 2026-09-13T00:00:00Z The code that executes on your machine is not the code you last approved. Compare the new command on the dossier against what you accepted. Kolbo — @kolbo/mcp now reaches network https://tashan.sh/capability/pkg-kolbo-mcp.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Run402 — mcp now reaches network https://tashan.sh/capability/pkg-run402-mcp.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Reactor — @powerhousedao/reactor-mcp has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-powerhousedao-reactor-mcp.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Docs · seed-design — @seed-design/docs-mcp has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-seed-design-docs-mcp.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Hunch — @davesheffer/hunch now reaches shell https://tashan.sh/capability/pkg-davesheffer-hunch.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Scraper — mcp-scraper now reaches database https://tashan.sh/capability/pkg-mcp-scraper.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Agent Network — @sleep2agi/agent-network now reaches browser https://tashan.sh/capability/pkg-sleep2agi-agent-network.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Monday API — @mondaydotcomorg/monday-api-mcp has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-mondaydotcomorg-monday-api-mcp.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Hicortex — @gamaze/hicortex now reaches network https://tashan.sh/capability/pkg-gamaze-hicortex.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Tribunal Kit — tribunal-kit now reaches database https://tashan.sh/capability/pkg-tribunal-kit.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Yawlabs — @yawlabs/mcp now runs a script when it installs https://tashan.sh/capability/pkg-yawlabs-mcp.html#install_script_added-2026-09-13 2026-09-13T00:00:00Z Install-time code executes on your machine before you have used the tool once, and it did not do this before. Read the command on the dossier — it is free — before your next install or CI run. Elements — elements now reaches filesystem https://tashan.sh/capability/pkg-nvidia-elements-cli.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Air — @air/mcp has a different set of npm maintainers than it did https://tashan.sh/capability/pkg-air-mcp.html#ownership_changed-2026-09-13 2026-09-13T00:00:00Z Who can publish this package changed — the classic supply-chain handoff, and invisible to a maintainer count that did not move. Pin the version you have audited and read the next release's diff before taking it. Abap Adt — @mcp-abap-adt/core now reaches credentials https://tashan.sh/capability/pkg-mcp-abap-adt-core.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Molecare — molecare-mcp now reaches credentials https://tashan.sh/capability/pkg-molecare-mcp.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Devlens — devlens now runs a script when it installs https://tashan.sh/capability/pkg-devlensio-cli.html#install_script_added-2026-09-13 2026-09-13T00:00:00Z Install-time code executes on your machine before you have used the tool once, and it did not do this before. Read the command on the dossier — it is free — before your next install or CI run. Google Surf — google-surf-mcp now reaches network https://tashan.sh/capability/pkg-google-surf-mcp.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Telephony — the command @hasna/telephony runs at install time changed https://tashan.sh/capability/pkg-hasna-telephony.html#install_script_changed-2026-09-13 2026-09-13T00:00:00Z The code that executes on your machine is not the code you last approved. Compare the new command on the dossier against what you accepted. Openwolf Enhanced — the command openwolf-enhanced runs at install time changed https://tashan.sh/capability/pkg-openwolf-enhanced.html#install_script_changed-2026-09-13 2026-09-13T00:00:00Z The code that executes on your machine is not the code you last approved. Compare the new command on the dossier against what you accepted. Axf — axf now runs a script when it installs https://tashan.sh/capability/pkg-smartergpt-axf.html#install_script_added-2026-09-13 2026-09-13T00:00:00Z Install-time code executes on your machine before you have used the tool once, and it did not do this before. Read the command on the dossier — it is free — before your next install or CI run. Aeonos — aeonos now reaches credentials https://tashan.sh/capability/pkg-aeonos-mcp.html#permissions_widened-2026-09-13 2026-09-13T00:00:00Z Its declared dependencies reach further into your machine than they did before. Confirm the new reach is something this tool should have. Vanta · @vantasdk — the author of @vantasdk/vanta-mcp-server has declared it unmaintained https://tashan.sh/capability/pkg-vantasdk-vanta-mcp-server.html#declared_unmaintained-2026-09-13 2026-09-13T00:00:00Z Nobody is going to fix the next problem with this, including a security one. Plan a replacement. The dossier links what else does this work. Debugging And Error Recovery — the author of debugging-and-error-recovery has declared it unmaintained https://tashan.sh/capability/skill-fworks-tech-debugging-and-error-recovery.html#declared_unmaintained-2026-09-13 2026-09-13T00:00:00Z Nobody is going to fix the next problem with this, including a security one. Plan a replacement. The dossier links what else does this work. Aarmos — @aarmos/cli was marked deprecated on npm https://tashan.sh/capability/pkg-aarmos-cli.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice. Afferens — @afferens/mcp-server was marked deprecated on npm https://tashan.sh/capability/pkg-afferens-mcp-server.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice. Circleci — @circleci/mcp-server-circleci was marked deprecated on npm https://tashan.sh/capability/pkg-circleci-mcp-server-circleci.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice. Machines — @hasna/machines was marked deprecated on npm https://tashan.sh/capability/pkg-hasna-machines.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice. Machines — the command @hasna/machines runs at install time changed https://tashan.sh/capability/pkg-hasna-machines.html#install_script_changed-2026-09-13 2026-09-13T00:00:00Z The code that executes on your machine is not the code you last approved. Compare the new command on the dossier against what you accepted. Cloud MCP Gateway — @opengsd/cloud-mcp-gateway was marked deprecated on npm https://tashan.sh/capability/pkg-opengsd-cloud-mcp-gateway.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice. Twin GitHub — @pome-sh/twin-github was marked deprecated on npm https://tashan.sh/capability/pkg-pome-sh-twin-github.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice. PDF Reader · sylphx — @sylphx/pdf-reader-mcp was marked deprecated on npm https://tashan.sh/capability/pkg-sylphx-pdf-reader-mcp.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice. Angular Assistant — @syncfusion/angular-assistant was marked deprecated on npm https://tashan.sh/capability/pkg-syncfusion-angular-assistant.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice. Blazor Assistant — @syncfusion/blazor-assistant was marked deprecated on npm https://tashan.sh/capability/pkg-syncfusion-blazor-assistant.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice. Rn Vectalon — @vectalon-dev/rn-vectalon was marked deprecated on npm https://tashan.sh/capability/pkg-vectalon-dev-rn-vectalon.html#deprecated-2026-09-13 2026-09-13T00:00:00Z The publisher is telling installers to stop using it. Move to the successor named in the deprecation notice.