Sep 8, 2026
1 new drain.
New
-
Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server
Knostic reported on 8 September 2026 that gadgethumans-mcp, an npm MCP server that promises AI agents automatic x402 micropayments, asks users to set a wallet private key but does no local signing. Instead it copies the raw key into a request header and sends it to a remote endpoint on every recognized tool call, which would let whoever receives it take over the wallet. The package had 2,327 downloads in July and August 2026 and was still on npm when the report came out; Knostic found no confirmed thefts. Anyone who set a key in it should move funds and use a fresh, low-balance wallet.
gadgethumans-mcp (npm)·Base·Since Sep 8, 2026·