
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A powerful SSH server implementation for Model Context Protocol (MCP). This server enables secure remote command execution and file operations through SSH protocol, supporting both password and key-based authentication.
npm install @modelcontextprotocol/server-ssh
claude_desktop_config.json):{
"mcpServers": {
"ssh": {
"command": "node",
"args": ["path/to/@modelcontextprotocol/server-ssh/dist/server.js"],
"env": {
"SSH_PORT": "8889",
"SSH_LOG_LEVEL": "info"
}
}
}
}
$body = @{
id = "test"
host = "example.com"
port = 22
username = "user"
password = "pass123"
} | ConvertTo-Json
Invoke-RestMethod -Uri "http://localhost:8889/connect" -Method Post -Body $body -ContentType "application/json"
$body = @{
id = "test"
host = "example.com"
port = 22
username = "user"
privateKey = Get-Content ~/.ssh/id_rsa | Out-String
passphrase = "optional-key-passphrase" # if your key is protected
} | ConvertTo-Json
Invoke-RestMethod -Uri "http://localhost:8889/connect" -Method Post -Body $body -ContentType "application/json"
$execBody = @{
id = "test"
command = "ls -la"
} | ConvertTo-Json
Invoke-RestMethod -Uri "http://localhost:8889/exec" -Method Post -Body $execBody -ContentType "application/json"
# Upload file
$uploadForm = @{
file = Get-Item -Path "localfile.txt"
remotePath = "/remote/path/file.txt"
}
Invoke-RestMethod -Uri "http://localhost:8889/upload/test" -Method Post -Form $uploadForm
# Download file
Invoke-RestMethod -Uri "http://localhost:8889/download/test?remotePath=/remote/path/file.txt" -Method Get -OutFile "downloaded.txt"
# List directory
Invoke-RestMethod -Uri "http://localhost:8889/ls/test?path=/remote/path" -Method Get
# Get connection status
Invoke-RestMethod -Uri "http://localhost:8889/status/test" -Method Get
git clone https://github.com/shaike1/mcp-server-ssh.git
cd mcp-server-ssh
npm install
npm run build
npm start
SSH_PORT: Server port (default: 8889)SSH_LOG_LEVEL: Logging level (default: info)git checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)MIT
FAQs
SSH Server for Model Context Protocol
The npm package mcp-ssh receives a total of 64 weekly downloads. As such, mcp-ssh popularity was classified as not popular.
We found that mcp-ssh demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.