Typosquatting is publishing a malicious package, server, or tool under a name nearly identical to a legitimate one. In the traditional software world this has been a known risk for years (e.g., lodahs vs lodash).

In agentic systems, the risk is amplified: the agent doesn't browse a search results page and check reviews. It queries a registry, reads a name and description, and decides whether to use it. The selection process is entirely text-driven.

The first documented in-the-wild malicious MCP server was found on npm in 2025. It was named and documented to impersonate the legitimate Postmark email API MCP server. Its API signatures, parameter names, and descriptions matched the real server.

What it did differently: every outgoing email sent through the server was silently BCC'd to an attacker-controlled email address. The agent's logs showed a normal email being sent. The user saw no indication anything was wrong.

The attack required no agent vulnerability. It exploited the agent's trust in the tool it selected from the registry.

The MCP ecosystem is growing rapidly. Every new legitimate MCP server that gains adoption creates an impersonation opportunity. An attacker who publishes postmark-mcp-server before the legitimate one achieves npm-name-squatting. As agent registries and tool marketplaces proliferate, so does the impersonation attack surface.

Agents that auto-discover and auto-install tools from public registries are particularly exposed — they're doing exactly what makes typosquatting effective at scale.