
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
MCP (Model Context Protocol) server for profiling Java applications via JDK utilities (jcmd, jfr, jps)
Enables AI assistants to diagnose performance, analyze threads, and inspect JFR recordings without manual CLI usage.
📦 Install: npm install -g javaperf or use via npx
🌐 npm: https://www.npmjs.com/package/javaperf
Add the server to your MCP config. Example for claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json
{
"mcpServers": {
"javaperf": {
"command": "npx",
"args": ["-y", "javaperf"]
}
}
}
For Cursor IDE: Settings → Features → Model Context Protocol → Edit Config, then add the same block inside mcpServers. See the Integration section for more options (local dev, custom JAVA_HOME, etc.).
JDK tools (jps, jcmd, jfr) are auto-detected via JAVA_HOME or which java. If not found, set JAVA_HOME to your JDK root.
# No installation needed - use directly in Cursor/Claude Desktop
# Just configure it as described in Integration section below
git clone https://github.com/theSharque/mcp-jperf.git
cd mcp-jperf
npm install
npm run build
npm run dev
npm start
Debug and test with MCP Inspector:
npx @modelcontextprotocol/inspector node dist/index.js
Installs from npm registry automatically:
{
"mcpServers": {
"javaperf": {
"command": "npx",
"args": ["-y", "javaperf"]
}
}
}
For local development with live changes:
{
"mcpServers": {
"javaperf": {
"command": "javaperf"
}
}
}
Requires: cd /path/to/mcp-jperf && npm link -g
{
"mcpServers": {
"javaperf": {
"command": "node",
"args": ["dist/index.js"],
"cwd": "${workspaceFolder}",
"env": {
"JAVA_HOME": "/path/to/your/jdk"
}
}
}
}
If list_java_processes fails with "jps not found", the MCP server may not inherit your shell's JAVA_HOME. Add the env block above with your JDK root path (e.g. /usr/lib/jvm/java-17 or ~/.sdkman/candidates/java/current).
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"javaperf": {
"command": "npx",
"args": ["-y", "javaperf"]
}
}
}
Edit .continue/config.json:
{
"mcpServers": {
"javaperf": {
"command": "npx",
"args": ["-y", "javaperf"]
}
}
}
| Tool | Description |
|---|---|
list_java_processes | List running Java processes (pid, mainClass, args). Use topN (default 10) to limit. |
start_profiling | Start JFR recording with settings=profile. Pass pid, duration (seconds). Optional: memorysize (e.g. "20M"), stackdepth (default 128). |
list_jfr_recordings | List active JFR recordings for a process. Use before stop_profiling to get recordingId. |
stop_profiling | Stop recording and save to recordings/new_profile.jfr. Requires pid and recordingId. |
check_deadlock | Check for Java-level deadlocks. Returns structured JSON with threads, locks, and cycle. |
analyze_threads | Thread dump (jstack) with deadlock summary. Pass pid, optional topN (default 10). |
heap_histogram | Class histogram (GC.class_histogram). Pass pid, optional topN (20), all (triggers full GC — may pause app). |
heap_dump | Create .hprof heap dump for MAT/VisualVM. Pass pid. Saved to recordings/heap_dump.hprof. |
heap_info | Brief heap summary. Pass pid. |
vm_info | JVM info: uptime, version, flags. Pass pid. |
trace_method | Build call tree for a method from .jfr. Pass className, methodName. Optional: filepath (default new_profile), topN. |
parse_jfr_summary | Parse .jfr into summary: top methods, GC stats, anomalies. Optional: filepath (default new_profile), events, topN. |
profile_memory | Memory profile: top allocators, GC, potential leaks. Optional: filepath (default new_profile), topN. |
profile_time | CPU bottleneck profile (bottom-up). Optional: filepath (default new_profile), topN. |
profile_frequency | Call frequency profile (leaf frames). Optional: filepath (default new_profile), topN. |
list_java_processesstart_profiling with pid and duration (e.g. 60)duration seconds (or let it run)list_jfr_recordings to get recordingIdstop_profiling with pid and recordingIdparse_jfr_summary, profile_memory, profile_time, profile_frequency, or trace_method (filepath defaults to new_profile)FAQs
MCP server for Java application profiling via JDK utilities (jcmd, jfr, jps)
We found that javaperf demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.