MCP's Design Flaw: How Agent Framework Supply Chains Became Security Blind Spots

This disclosure exposes critical structural flaws in MCP's supply chain that make credential leaks exponentially more dangerous than traditional npm packages. The fa-mcp-sdk package leaked multiple production credentials—API keys, database passwords, and LDAP service accounts—that instantly reached thousands of installations without human review or version control, potentially enabling attackers to compromise financial infrastructure, escalate privileges, and exfiltrate sensitive data.