
Threat Research
/Security News
Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
@popnow/mcp
Advanced tools
Local stdio bridge to the PopNow remote MCP server: AI image, video, music and speech generation for any MCP client.
@popnow/mcp is a tiny local stdio bridge to the PopNow remote MCP server
(https://api.popnow.ai/mcp). It lets MCP clients that only start local stdio servers use PopNow's
AI image, video, music and speech tools.
The bridge has no tools of its own: it forwards every MCP message to the remote server with your API key, so the tool list, prices and confirmations always match the live service.
If your client supports remote (Streamable HTTP) servers, you do not need this package. Add
https://api.popnow.ai/mcp directly and sign in with OAuth. See the main README.
Add it to your MCP client config; npx downloads and runs it (Node.js 18 or newer):
{
"mcpServers": {
"popnow": {
"command": "npx",
"args": ["-y", "@popnow/mcp"],
"env": { "POPNOW_API_KEY": "sk-popnow-..." }
}
}
}
| Variable | Required | Description |
|---|---|---|
POPNOW_API_KEY | yes | A PopNow API key from popnow.ai/api/console/keys |
POPNOW_MCP_URL | no | Override the endpoint (default https://api.popnow.ai/mcp) |
npx @popnow/mcp --help prints the same information. Diagnostics go to stderr; stdout carries only MCP messages.
import { createBridge } from "./dist/index.js";
const bridge = createBridge({ apiKey: process.env.POPNOW_API_KEY! });
await bridge.start();
npm install
npm test # builds with tsc, then runs an end-to-end test against a local fake MCP server
MIT
FAQs
Local stdio bridge to the PopNow remote MCP server: AI image, video, music and speech generation for any MCP client.
The npm package @popnow/mcp receives a total of 27 weekly downloads. As such, @popnow/mcp popularity was classified as not popular.
We found that @popnow/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.