
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
mcp-server-npms
Advanced tools
MCP server for npms.io API access with support for package search, suggestions, and detailed package information. Features include advanced search qualifiers for filtering by scope, author, maintainer, keywords, and package status (deprecated, unstable, i
MCP (Model Context Protocol) is a framework that allows you to integrate custom tools into AI-assisted development environments—such as Cursor AI. MCP servers expose functionality (like data retrieval or code analysis) so that an LLM-based IDE can call these tools on demand. Learn more about MCP in the Model Context Protocol Introduction.
This project demonstrates an MCP server built in Node.js that provides powerful NPM package search and information retrieval capabilities through the npms.io API. It offers tools for searching packages, getting package suggestions, and retrieving detailed package information.
scope:types)StdioServerTransport for integration with development environmentsClone the Repository
git clone <repository_url>
cd <repository_directory>
Install Dependencies
npm install
This project includes a ./cursor subdirectory that contains an mcp.json file for configuring the MCP server. Cursor AI uses this file to automatically discover and launch your MCP server.
./cursor/mcp.json Structure{
"mcpServers": {
"npms": {
"command": "npx",
"args": [
"-y",
"mcp-server-npms"
]
}
}
}
You can verify the absolute path to your Node.js executable by running which node in your terminal.
Easily configure your local environment by automatically updating the mcp.json file with the correct absolute paths:
chmod +x ./scripts/update_config.sh
./scripts/update_config.sh
You can also move the mcp.json file to your global Cursor AI configuration directory located at ~/.cursor to make the configuration available globally.
With the MCP server integrated into Cursor AI and with Agent mode enabled in Cursor Composer, you can use natural language prompts like:
search for react packages that are not deprecated
get information about the express package
get suggestions for "react-router"
The AI agent will infer the appropriate tool from your MCP server and execute it accordingly.
https://api.npms.io/v2: NPM package search and information interfacesearch
q (String): Search query with support for filters and modifiers:
search_suggestions
q (String): Search query (qualifiers will be ignored)get_package_info
name (String): Package name to get information forget_multi_package_info
names (String[]): Array of package names to get information forModel Context Protocol (MCP) provides a standardized approach to integrate custom tools into AI-assisted development environments. With MCP, you can define tools that perform specific tasks—such as retrieving external data, validating code, or enforcing coding standards—and the AI assistant in your IDE can call these tools automatically based on context. This helps improve developer productivity, ensures consistent quality, and streamlines workflows.
This project is licensed under the MIT License.
FAQs
MCP server for npms.io API access with support for package search, suggestions, and detailed package information. Features include advanced search qualifiers for filtering by scope, author, maintainer, keywords, and package status (deprecated, unstable, i
The npm package mcp-server-npms receives a total of 2 weekly downloads. As such, mcp-server-npms popularity was classified as not popular.
We found that mcp-server-npms demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.